ftp.whtech.com/ftp.whtech.com.tar/ftp.whtech.com/ti-990/TI990_12.txt

Text File | 2006-10-19 | 115KB | 4,511 lines

; TI990/12 LOAD ROMs disassembly
;
;General background :
; These ROMs contain the handler for the LOAD/RESTART interrupt.  This interrupt is called at
; start-up (instead of RESET, which is used for "warm reset", I think), so that the boot loader in
; ROMs can be executed.
;
; This interrupt can also be triggered by the programmer panel, and there is code to handle the
; panel functions.
;
;Description :
; We have one single 8kb ROM set (2 4k*8 ROMs).
;
; First 4kb contain TI990/12 machine code.  They are paged in four 1kb pages.
; All these pages are always located at >FC00.
;
; Last 4kb make no sense.
;
; Page 0 includes programmer panel handling and boot strap code, and a small bit of auto-test code.
; Pages 1-3 include remaining auto-test code.
;
; These ROMs are a source of information on the boot process and TI990/12 hardware.
;
; If you want a starting point, you can have a look at the LOAD vector located at >FFFC (page 0).
; The LOAD routine starts at >FC44 (page 0).
;
; The ROMs are obviously an instance of the "universal ROM loader" as described in the
; Model 990 Universal ROM Loader User's Guide.
; You should read the Universal ROM Loader User's Guide before reading the disassembly.
;
; The ROM basically do the following :
; * handle programmer panel functions if applicable
; * perform extensive self-test
; * look for a MDU, and boot from it if present
; * if programmer panel disabled, boot from the first tape/disk unit it finds (using a MT3200/WD900
;  controller or equivalent)
; * if programmer panel enabled, boot from the unit designated in RO/R1/R2 (either ASR tape,
;  FD800 single-sided disk, or tape/disk based on a MT3200/WD900 controller or equivalent)
;
;Conventions used :
; TMS9900 assembly conventions should have been respected.  Particularily :
; * bit are numbered from MSB to LSB (unlike almost every other CPU)
; * format for TI990/12-specific instructions was mostly guessed, therefore it is unlikely to be
; very accurate.  Specifically, operand order is probably wrong.
;
; Raphael Nabet, 2000/04/24
;
; revision history :
; 2000/04/24 : explicited MT3200 tape unit support
; 2000/02/23 : fixed a few comments, clarified a few things with MDU support, found out what LCS does
; 2000/02/20 : initial release




; Notes on TI990/12 CPU
;
; TI990/12 should be backward compatible with TI990/10 & TMS9900.  It includes the memory mapping
; feature, which is optionnal on TI990/10.  Additionnally, it has many extra features and opcodes.
; Some of them are implemented in the tms99000 family.  Many are not.
;
;Overview :
;
; * Multiple-byte / Extended (i.e. 32-bit) integers support
; * Multiple-byte ("string") move and compare operations
; * Floating-point real support (single-precision & double-precision)
; * Decimal ascii to/from binary conversion
; * "Writable Control Storage (WCS) - In the model 990/12 Computer, an area set aside that contains
;   microcode that is executable by the user tasks via a an XOP instruction within the user program."
;   (Source : Model 990 Computer DX10 Operating System Concept and Facilities Manual Volume 1 A-12,
;   page 77)
; * Stack operations (I have no idea how they work - no SP register AFAIK)
; * Possibility to declare some memory areas as read-only, data or program, etc.
; * ...
;
; This makes more than 140 instruction types (vs. 69 on TMS9900, and 84 on TMS99105).
; Wow, THIS is a CISC processor :-) .
;
;
;Data types :
;
; Single-precision & double-precision real.
;
; Guessed format :
; 1 bit : sign S
; 7 bits : exponent E (binary, bias >40, power of 16)
; 7/3 bytes : fractional part of mantissa M (binary) (integer part = 0)
; so the number is S * 16^(E - >40) * 0.M
;
; The only difference between single-precision and double-precision appears to be the size of
; mantissa (24 bits vs. 56 bits).
;
; Of course, IEEE double lacks 2 bits to be able to represent TI990/12 double.  Quite unpractical
; for those who want to emulate TI990/12 :-( .
;
;Instruction formats :
;
; "String" and "multiple arithmetic" instructions include a 4-bit immediate.
; It appears to be a byte count.
; They use a register, too.  I don't know what it is used for, exactly.  It is always set to >FFFF
; as input.  It is used once as output, and tells how many bytes CS found to be similar.  I guess
; it is incremented each time a byte is handled.  Since it is always set to >FFFF before each
; string instruction, maybe it changes the operation mode, or provides a byte count.
;
; There are only few instances of field instructions and stack instructions, so I cannot say anything
; for sure.  You can search for MVSK, IOF, XV if you like.
;







; ROM page 0.
; LOAD vector, programmer panel handling.

; error handler when the switch from ROM page 0 to page 1 fails (code at >FC40->FC42)
FC00: 02E0 0080           LWPI >0080
FC04: 0206 0200           LI   R6,>0200

; return point when the self test was unsuccessful
FC08: 020C 1FE0           LI   R12,>1FE0
FC0C: 1F0E                TB   >000E
FC0E: 1601                JNE  >FC12
FC10: 1D0A                SBO  >000A
FC12: 1D0B                SBO  >000B
FC14: 3206                LDCR R6,8             ; display progress code
FC16: 3220 008D           LDCR @>008D,8
FC1A: 10FF                JMP  >FC1A            ; stop

; return point when the self test was successful
FC1C: 1068                JMP  >FCEE


; entry point for self-test
FC1E: 0360                RSET                  ; reset peripherals
FC20: 020C 1FE0           LI   R12,>1FE0
FC24: 1D0B                SBO  >000B
FC26: 04C6                CLR  R6
FC28: 3206                LDCR R6,8             ; clear panel
FC2A: 3220 008D           LDCR @>008D,8
FC2E: 02E0 0080           LWPI >0080
FC32: 002D                EMD                   ; Execute Micro-Diagnostics : microcode test
FC34: 020C 1FB4           LI   R12,>1FB4        ; Page switch
FC38: 0204 0100           LI   R4,>0100
FC3C: 0205 FC00           LI   R5,>FC00
FC40: 30C4                LDCR R4,3             ; switch to page #1
FC42: 0455                B    *R5              ; jump to self test code at >FC00


; LOAD vector entry point
FC44: 020C 1FE0           LI   R12,>1FE0        ; programmer panel CRU base
FC48: 0221 6700           AI   R1,>6700         ; look for magical value (>9900)
FC4C: 1602                JNE  >FC52            ; continue with normal vector if not found
FC4E: 1D0A                SBO  >000A            ; switch "Run" light on
FC50: 0450                B    *R0              ; branch to routine if found

FC52: 0209 00A0           LI   R9,>00A0         ; R9 points to free area in RAM ?
FC56: 0700                SETO R0               ; R0 < 0 : use TILINE unit (tape, FD1000, hard disk) by default
FC58: 0201 F800           LI   R1,>F800         ; TILINE address for default disk unit
FC5C: 0202 0800           LI   R2,>0800         ; if programmer panel enabled, boot from drive unit 0 by default
FC60: 1F0B                TB   >000B
FC62: 13DD                JEQ  >FC1E            ; if programmer panel disabled, jump to self-test

FC64: C10E                MOV  R14,R4           ; load old PC to display it

; programmer panel scan : we have 4 rows of 8 switches
; 16 switches allow to toggle the display in R4.
; the 16 other switches allow to access programmer panel functions.
;
; register conventions here :
; R4 = data register
; R7 = memory address register
; R13 = WP
; R14 = PC
; R15 = ST

; keyscan loop start
FC66: 3204                LDCR R4,8             ; display data register MSB
FC68: 3220 0089           LDCR @>0089,8         ; display data register LSB

FC6C: 0205 FCD0           LI   R5,>FCD0
FC70: 0695                BL   *R5              ; read current 8 switches from programmer panel to R3 MSB
FC72: 16FE                JNE  >FC70            ; wait for all switches to be released
FC74: 0695                BL   *R5
FC76: 16FC                JNE  >FC70            ; test again to fix switch bounce problems
FC78: 0695                BL   *R5
FC7A: 16FA                JNE  >FC70            ; again
FC7C: 04C3                CLR  R3
FC7E: 1D08                SBO  >0008            ; "Increment scan" bit -> select another row of switches
FC80: 0695                BL   *R5
FC82: 13FD                JEQ  >FC7E            ; if no switch pressed, scan next row
FC84: 0695                BL   *R5
FC86: 13FB                JEQ  >FC7E            ; fixes switch bounce problems
FC88: 0695                BL   *R5
FC8A: 13F9                JEQ  >FC7E            ; again

FC8C: 1F09                TB   >0009            ; scan count bit 0 -> is current switch row number odd or even ?
FC8E: 1601                JNE  >FC92
FC90: 06C3                SWPB R3               ; if odd, we read last 8 switches in 16 switches, so we rotate 8 bits
FC92: 1F08                TB   >0008            ; scan count bit 1 -> is this command switches or data switches ?
FC94: 1302                JEQ  >FC9A            ; command switches -> jump to interpret command
FC96: 2903                XOR  R3,R4            ; data switches -> toggle the data on display as requested
FC98: 10E6                JMP  >FC66            ; update display and go back to scan routine

FC9A: 04C5                CLR  R5
FC9C: 05C5                INCT R5
FC9E: 0A13                SLA  R3,1
FCA0: 17FD                JNC  >FC9C            ; count first bit set to 1 in R3, i.e. first switch pressed
FCA2: 04A5 FCA6           X    @>FCA6(R5)       ; execute command as needed
FCA6: 10DF                JMP  >FC66            ; jump to display value if the X instruction did not jump

; Programmer panel instruction table.
; All jump offsets must be relative to FCA6 since this is the value of PC when the instruction
; is executed.
FCA8: 1013                JMP  *+>FCCC->FCA6    ; "Halt/SIE" switch
FCAA: 1011                JMP  *+>FCC8->FCA6    ; "Run" switch
FCAC: 0360                RSET                  ; "Reset" switch
FCAE: 10BC                JMP  *+>FC1E->FCA6    ; "Load" switch
FCB0: C10D                MOV  R13,R4           ; "Display WP" switch
FCB2: C10E                MOV  R14,R4           ; "Display PC" switch
FCB4: C10F                MOV  R15,R4           ; "Display ST" switch
FCB6: C107                MOV  R7,R4            ; "Display MA" switch
FCB8: C344                MOV  R4,R13           ; "Enter WP" switch
FCBA: C384                MOV  R4,R14           ; "Enter PC" switch
FCBC: C3C4                MOV  R4,R15           ; "Enter ST" switch
FCBE: C1C4                MOV  R4,R7            ; "Enter MA" switch
FCC0: C117                MOV  *R7,R4           ; "MDD" switch ("Memory Data Display")
FCC2: 05C7                INCT R7               ; "MAI" switch ("Memory Address Increment")
FCC4: C5C4                MOV  R4,*R7           ; "MDE" switch ("Memory Data Enter")
FCC6: 04C4                CLR  R4               ; "CLR" switch

; Code for run switch
FCC8: 1D0A                SBO  >000A            ; switch "Run" light on
FCCA: 0380                RTWP

; code for "Halt/SIE" switch
FCCC: 1D0E                SBO  >000E            ; set "Single Instruction Execute"
FCCE: 0380                RTWP                  ; Restart trap will occur after 2 instructions
; The second instruction executed will be an instruction from the program we interrupted.
; Pressing the HALT/SIE switch repetitively, you will trace the current program.


; this routine read a row of 8 switches from the programmer panel
FCD0: 1D0D                SBO  >000D            ; start panel timer
FCD2: 1F0A                TB   >000A            ; wait for timer active bit to be set
FCD4: 16FE                JNE  >FCD2
FCD6: 3603                STCR R3,8             ; retrieve value
FCD8: 045B                B    *R11


; Real boot routine, called after the CPU self-test
;
; We can load from several devices : MDU (Maintenance Diagnostics Unit, with a tape reader),
; ASR (a data terminal with optionnal tape reader), a single-sided disk (dumb controller on CRU bus),
; a tape unit with MT3200 controller, a double-sided floppy disk or a hard disk with WD900 controller
; (intelligent controllers on TI-LINE memory bus).
;
; tape units (MDU, ASR and MT3200) use some object code encoded with alphanumeric and hexadecimal
; characters.
; Single-sided floppy uses a simple boot routine to fetch a binary start-up program.
; The routine for double-sided floppies and hard-disk is somewhat more complex.


; offset table for jumps in object code interpreter, used on >FD6C (offsets relative to >FD6C)
FCDA: 302C 2A04           BYTE >FD9C->FD6C, >FD98->FD6C, >FD96->FD6C, >FD70->FD6C
FCDE: 0404 041A           BYTE >FD70->FD6C, >FD70->FD6C, >FD70->FD6C, >FD86->FD6C
FCE2: E60C 0A12           BYTE >FD52->FD6C, >FD78->FD6C, >FD76->FD6C, >FD7E->FD6C
FCE2: 1022 1E00           BYTE >FD7C->FD6C, >FD8E->FD6C, >FD8A->FD6C, >00
FCEA: 0404 30E6           BYTE >FD70->FD6C, >FD70->FD6C, >FD9C->FD6C, >FD52->FD6C


; actual boot routine
FCEE: 0360                RSET                  ; RESET external peripherals
FCF0: 0203 FEBE           LI   R3,>FEBE         ; address of the start-up routine we jump to - defaults to error routine
FCF4: 0205 F7FE           LI   R5,>F7FE         ; last word before system memory space
FCF8: C381                MOV  R1,R14           ; if programmer panel enabled, TILINE peripheral to boot from
FCFA: C3C2                MOV  R2,R15           ; if programmer panel enabled, unit to load from

; simple memory test >F7FE -> >0000
FCFC: C555                MOV  *R5,*R5          ; try to read and write current word
FCFE: 0645                DECT R5
FD00: 18FD                JOC  >FCFC            ; loop until we wrap around to >FFFE

; now real boot
FD02: 020C 1FE0           LI   R12,>1FE0
FD06: 1D0A                SBO  >000A            ; switch "Run" light on
FD08: 1F0E                TB   >000E            ; this bit must tell a MDU is present
FD0A: 1302                JEQ  >FD10            ; jump if not present
FD0C: 04C0                CLR  R0
FD0E: 101D                JMP  >FD4A            ; boot from the MDU ?

FD10: C000                MOV  R0,R0            ; read boot device type (defaults to -1)
FD12: 114E                JLT  >FDB0            ; boot from TILINE tape or disk device (FD1000, hard disk...)
FD14: 154C                JGT  >FDAE            ; boot from FD800 single-sided floppy disk
; if (R0 == 0), boot from ASR terminal
FD16: 04CC                CLR  R12              ; device address >000 : 733 ASR
FD18: 1D09                SBO  >0009            ; set-up device
FD1A: 1D0A                SBO  >000A
FD1C: 3220 FEB4           LDCR @>FEB4,8         ; effectively writes >11

; entry point to boot from TILINE tape unit (MT3200 controller or equivalent)
FD20: 04CD                CLR  R13
FD22: C000                MOV  R0,R0
FD24: 1312                JEQ  >FD4A            ; skip if booting from ASR
FD26: C183                MOV  R3,R6            ; save R3, R5
FD28: C285                MOV  R5,R10
FD2A: 04C0                CLR  R0               ; meaningless
FD2C: 04C1                CLR  R1               ; meaningless
FD2E: 04C2                CLR  R2               ; read offset = 0 (read record from the beginning)
FD30: 0203 0050           LI   R3,>0050         ; char count = >0050 (max record lenght = 80 chars)
                                                ; It seems we cannot have more than 80 bytes of code !
FD34: 04C4                CLR  R4               ; load at address 0
FD36: 0205 0400           LI   R5,>0400         ; >4 : read binary forward command
FD3A: E14F                SOC  R15,R5           ; set unit ID
FD3C: 06A0 FF7E           BL   @>FF7E           ; execute command on tape unit
FD40: D920 FE99 0050      MOVB @>FE99,@>0050(R4)    ; append carriage return after the data we read (@>FE99 = >0D)
FD46: C0C6                MOV  R6,R3            ; restore R3, R5
FD48: C14A                MOV  R10,R5

; entry point to boot from MDU
FD4A: 020B FEBC           LI   R11,>FEBC        ; pointer to read routine
FD4E: 04C7                CLR  R7               ; clear checksum
FD50: 058D                INC  R13

; object code interpreter
;
; ASR, MDU and MT3200 tapes use object code, as described in the Model 990 Computer Programming Card.
;
; We receive characters from the boot device.  These are interpreted as commands or as hexadecimal
; immediate operands.  Note that we actually only use hexadecimal characters, and 'G','H',':'.
;
; Commands with 16-bit immediate (encoded in hexadecimal) :
; * '1' : Absolute Entry Address : boot routine address = IMM
; * '2' : Relocatable Entry Address : boot routine address = offset + IMM
; * '7' : Checksum : stops the machine if (sum of all data received since start of record) + IMM != 0
; * '9' : Absolute Load Address : memory address pointer = IMM
; * 'A' : Relocatable Load Address : memory address pointer = offset + IMM
; * 'B' : Absolute Data : * (memory address pointer ++) = IMM
; * 'C' : Relocatable Data : * (memory address pointer ++) = offset + IMM
; * 'D' : Load Bias Or Offset : offset = IMM
; * 'E' : (no reference) : stop the machine
;
; Control commands (parameter-less) :
; * ':' : (no reference) : branch to boot routine address
; * 'F' : End Of Record : wait for next card to be inserted (does not really work)
;
; Unsupported commands with 16-bit immediate (encoded in hexadecimal) :
; * '8' : Ignore Checksum Value : does nothing
; * 'J' : (no reference)
; Unsupported commands with 16-bit immediate (encoded in hexadecimal) and 6-char symbol name :
; * '3', '4', '5', '6', 'G', 'H' (symbol-related commands)
; Unsupported commands with 16-bit immediate (encoded in hexadecimal) and 8-char program name :
; * '0' : Program Start
; * 'I' : (no reference)
;
FD52: 069B                BL   *R11             ; read command number in R10 from tape (range 0-19)
FD54: D0AA FCDA           MOVB @>FCDA(R10),R2   ; read offset to routine in table
FD58: 1327                JEQ  >FDA8            ; handle 'F' command separately because it is parameter-less
FD5A: 0882                SRA  R2,8             ; convert to signed 16-bit offset
FD5C: C207                MOV  R7,R8            ; save checksum
FD5E: 0201 0004           LI   R1,>0004         ; 4*4 = 16 bits to read
FD62: 069B                BL   *R11             ; read hex digit (4 bits)
FD64: 0A46                SLA  R6,4             ; shift digits we have already read
FD66: A18A                A    R10,R6           ; and insert new digit in R6
FD68: 0601                DEC  R1
FD6A: 16FB                JNE  >FD62            ; loop until we have read a 16-bit hex value
FD6C: 0462 FD6C           B    @>FD6C(R2)       ; jump to routine

; entry point for '3', '4', '5', '6','G','H'
; read 6 additional characters and ignore them
FD70: 0201 0006           LI   R1,>0006         ; read 6 chars
FD74: 1015                JMP  >FDA0

; entry point for 'A'
; add offset to R6, set address pointer
FD76: A189                A    R9,R6            ; add offset to R6 (R9 set by 'D' command, defaults to >00A0)
; entry point for '9'
; set address pointer
FD78: C146                MOV  R6,R5
FD7A: 10EB                JMP  >FD52            ; next command

; entry point for 'C'
; add offset to R6, write two bytes
FD7C: A189                A    R9,R6
; entry point for 'B'
; write two bytes
FD7E: DD46                MOVB R6,*R5+
FD80: 06C6                SWPB R6
FD82: DD46                MOVB R6,*R5+
FD84: 10E6                JMP  >FD52

; entry point for '7'
; check checksum
FD86: A206                A    R6,R8
FD88: 13E4                JEQ  >FD52            ; continue on if value matches checksum
; entry point for 'E'
; boot failure
FD8A: 046B 0002           B    @>0002(R11)      ; jump to >FEBE (stop machine and blink fail LED)

; entry point for 'D'
; set bias/offset
FD8E: C246                MOV  R6,R9            ; set bias/offset value
FD90: 0249 FFFE           ANDI R9,>FFFE         ; convert to word address
FD94: 10DE                JMP  >FD52

; entry point for '2'
; add offset to R6, set boot routine address
FD96: A189                A    R9,R6
; entry point for '1'
; set boot routine address
FD98: C0C6                MOV  R6,R3            ; set boot routine address
FD9A: 10DB                JMP  >FD52

; entry point for '0','I'
; read 8 additionnal characters and ignore them
FD9C: 0201 0008           LI   R1,>0008         ; read 8 chars
FDA0: 069B                BL   *R11
FDA2: 0601                DEC  R1
FDA4: 16FD                JNE  >FDA0
FDA6: 10D5                JMP  >FD52

; entry point for 'F' command (parameter-less)
; wait for next record
FDA8: 069B                BL   *R11
FDAA: 16FE                JNE  >FDA8            ; wait for next record
FDAC: 10BA                JMP  >FD22


; branch point to routine at >FE18
FDAE: 1034                JMP  >FE18


; Boot from a tape/disk unit using MD900/MT3200 controller or equivalent on the TILINE bus
;
; When programmer panel is available, the routine expect the unit mask to be in R15.
;
; When programmer panel is unavailable, the routine scans tape units 0-3, then disk units 0-3.
; It generally boots on the first unit which is ready ; however, when possible, it does not boot from
; a writable disk.  The resulting priority order is : tape #0, ..., tape #3,
; disk #0 (write-protected), ..., disk #3 (write-protected),
; disk #0 (writable), ..., disk #3 (writable).  When no unit is ready, it keeps scanning
; all units continuously, so that the user can insert a boot disk/tape after start-up.
;
; R1 = >F800 (?)
; R2 = >0800 (?)

FDB0: 04CD                CLR  R13
FDB2: 1F0B                TB   >000B            ; programmer panel...
FDB4: 1306                JEQ  >FDC2            ; if disabled, try each unit until we find a bootable one

FDB6: C10F                MOV  R15,R4           ; current unit mask : 1 (and only 1) bit must be set
FDB8: 0A44                SLA  R4,4
FDBA: 13B2                JEQ  >FD20            ; routine for tape unit
FDBC: 102C                JMP  >FE16            ; routine for disk unit


; we end here when no tape or writable disk could be found.
; R13 may contain the ID of some write-protected disk.
FDBE: C3CD                MOV  R13,R15          ; restore unit ID from R13
FDC0: 162A                JNE  >FE16            ; jump to boot routine if non-zero
                                                ; else, we start over, until someone insert a disk/tape

; Find a bootable tape/disk on the TILINE bus
FDC2: 020C 1FC0           LI   R12,>1FC0        ; Error interrupt register CRU base
FDC6: 020F 0001           LI   R15,>0001
FDCA: 020E F880           LI   R14,>F880        ; TILINE base address for MT3200 tape controller

FDCE: 1E0F                SBZ  >000F            ; clear TIMEOUT (i.e. unimplemented memory)
FDD0: 0B1F                SRC  R15,1            ; try next unit (try >8000 first, then >4000, etc)
FDD2: 808F                C    R15,R2           ; compare with >0800 (support for up to 4 tape units)
FDD4: 1B03                JH   >FDDC            ; jump if greater than >0800

FDD6: C381                MOV  R1,R14           ; else use WD900 disk unit at base address >F800
FDD8: D3CF                MOVB R15,R15          ; if R15 MSByte is NULL, we are done
FDDA: 13F1                JEQ  >FDBE            ; jump to boot from writable disk, or retry

FDDC: C21E                MOV  *R14,R8          ; load disc status
FDDE: 1F0F                TB   >000F            ; test RAM TIMEOUT
FDE0: 13F6                JEQ  >FDCE            ; try next unit if no controller found on bus

FDE2: C22E 000E           MOV  @>000E(R14),R8   ; load controller status
FDE6: 1101                JLT  >FDEA            ; wait for IDLE status bit to be cleared
FDE8: 10FC                JMP  >FDE2

FDEA: 04DE                CLR  *R14             ; clear disc status
FDEC: CB8F 000C           MOV  R15,@>000C(R14)  ; select unit
FDF0: 808F                C    R15,R2
FDF2: 1204                JLE  >FDFC            ; skip 2 instructions if using disk unit
FDF4: EB82 000C           SOC  R2,@>000C(R14)   ; bits 4-7 = >8 : read transport status command
FDF8: 04EE 000E           CLR  @>000E(R14)      ; clear controller status

FDFC: 0206 5E00           LI   R6,>5E00
FE00: 0606                DEC  R6
FE02: 16FE                JNE  >FE00            ; wait for about 10 or 20ms

FE04: C21E                MOV  *R14,R8          ; read disk or tape transport status
FE06: 11E3                JLT  >FDCE            ; try next unit if off-line status bit set (no unit or no tape/disk)
FE08: 808F                C    R15,R2
FE0A: 1B8A                JH   >FD20            ; if this is a tape unit, jump to object code interpreter
FE0C: C34D                MOV  R13,R13
FE0E: 1601                JNE  >FE12
FE10: C34F                MOV  R15,R13          ; save R15 in R13 if it is the first bootable unit found
FE12: 0A38                SLA  R8,3
FE14: 17DC                JNC  >FDCE            ; try next unit if the disk is not write-protected (?)
FE16: 1061                JMP  >FEDA            ; jump to disk boot routine if the disk is write-protected (?)


; Complete boot routine to boot from a single-sided diskette
; Boots from FD800 unit at CRU address >80->A0 (i.e. >40->50)
FE18: 020C 00A0           LI   R12,>00A0        ; CRU base address for command register ?
FE1C: 0702                SETO R2               ; R2 = >FFFF
FE1E: 04C3                CLR  R3
FE20: 3408                STCR R8,16            ; read 16 bits
FE22: 1502                JGT  >FE28
FE24: 0A68                SLA  R8,6             ; if negative, test CRU bit >A5
FE26: 1814                JOC  >FE50            ; if bit set, start over

FE28: 1F0A                TB   >000A
FE2A: 13FE                JEQ  >FE28            ; wait for something
FE2C: 3002                LDCR R2,16            ; write all 1s
FE2E: 0208 E000           LI   R8,>E000
FE32: E203                SOC  R3,R8
FE34: 1F0A                TB   >000A
FE36: 13FE                JEQ  >FE34            ; wait again
FE38: 3008                LDCR R8,16            ; write track number ???
FE3A: 1F0F                TB   >000F
FE3C: 16FE                JNE  >FE3A
FE3E: 3408                STCR R8,16            ; read 16 bits
FE40: 0248 1BFC           ANDI R8,>1BFC
FE44: 1306                JEQ  >FE52            ; start boot
FE46: 0223 0400           AI   R3,>0400
FE4A: 0283 1000           CI   R3,>1000
FE4E: 1AEE                JL   >FE2C
FE50: 10E3                JMP  >FE18            ; start over


FE52: 020C 0080           LI   R12,>0080        ; CRU base address for data register ?
FE56: C289                MOV  R9,R10           ; R9 points to free area in RAM ?

FE58: 0201 0080           LI   R1,>0080         ; 256 bytes (= 128 words) in a data cluster ?

FE5C: 1F11                TB   >0011            ; data present bit (?)
FE5E: 1306                JEQ  >FE6C
FE60: 1F1A                TB   >001A            ; device error bit (?)
FE62: 13FC                JEQ  >FE5C
FE64: 020C 00A0           LI   R12,>00A0
FE68: 3403                STCR R3,16
FE6A: 102A                JMP  >FEC0            ; stop the machine in error

FE6C: 343A                STCR *R10+,16         ; read 16 bits
FE6E: 1E0F                SBZ  >000F
FE70: 0641                DECT R1
FE72: 15F4                JGT  >FE5C            ; loop until read 256 bytes

FE74: 064A                DECT R10              ; point to last word
FE76: 809A                C    *R10,R2          ; compare last word with >FFFF mark
FE78: 16EF                JNE  >FE58            ; if different, keep 254 previous bytes and append another sector (?)

FE7A: 0360                RSET                  ; else, jump to boot routine
FE7C: 0200 FEC8           LI   R0,>FEC8
FE80: CE43                MOV  R3,*R9+          ; write device number
FE82: 0459                B    *R9              ; execute boot routine at offset 2


; read routine
; Read ASCII character from 733 ASR located at >000, a MDU unit located at >FF0, or a MT3200 tape unit
; on TILINE bus, and translate it to one hexadecimal number.
FE84: C000                MOV  R0,R0            ; test device type flag
FE86: 1105                JLT  >FE92            ; jump if MT3200

FE88: 1F0C                TB   >000C
FE8A: 16FE                JNE  >FE88            ; wait...

FE8C: 1E0C                SBZ  >000C
FE8E: 35CA                STCR R10,7            ; read 7 bits
FE90: 1001                JMP  >FE94


FE92: D2B4                MOVB *R4+,R10         ; read byte from memory (MT3200 is DMA driven)

FE94: 098A                SRL  R10,8            ; move MSB to LSB
FE96: 028A 000D           CI   R10,>000D        ; carriage return ? (appended at end of MT3200 record)
FE9A: 130F                JEQ  >FEBA            ; if so return
FE9C: 028A 005A           CI   R10,>005A        ; greater than 'Z' ?
FEA0: 15F1                JGT  >FE84            ; if so, ignore current char and read next char
FEA2: 028A 0020           CI   R10,>0020        ; control character (lower than ' ') ?
FEA6: 11EE                JLT  >FE84            ; if so, ignore current char and read next char
FEA8: A1CA                A    R10,R7           ; update checksum
FEAA: 022A FFD0           AI   R10,>FFD0        ; substract >30 (numeric character -> numeric value)
FEAE: 028A 000A           CI   R10,>000A
FEB2: 1307                JEQ  >FEC2            ; jump to handler if it is ':'
FEB4: 1102                JLT  >FEBA            ; if greater, it must be 'A'-'F'
FEB6: 022A FFF9           AI   R10,>FFF9        ; convert to hex value
FEBA: 069B                BL   *R11             ; trick : return to the caller AND restore R11 to be >FEBC

; read routine entry point
FEBC: 10E3                JMP  >FE84

; entry point for bad ':' (called when no '1' command has been executed before ':')
FEBE: C0CD                MOV  R13,R3
FEC0: 1057                JMP  >FF70

; handler for ':' command
FEC2: C000                MOV  R0,R0            ; test boot device type flag
FEC4: 1608                JNE  >FED6

FEC6: 1E0B                SBZ  >000B            ; clean-up ?
FEC8: 1E0C                SBZ  >000C
FECA: 0581                INC  R1
FECC: 16FE                JNE  >FECA
FECE: 1F0C                TB   >000C
FED0: 13F8                JEQ  >FEC2
FED2: 1E09                SBZ  >0009
FED4: 1E0D                SBZ  >000D

FED6: 0360                RSET                  ; reset all peripherals
FED8: 0453                B    *R3              ; jump to boot routine


; boot from a disk unit attached to a WD900 disk controller (or equivalent) whose address is in R14
FEDA: C14F                MOV  R15,R5           ; unit ID
FEDC: 020C FF7E           LI   R12,>FF7E
FEE0: 020D 0005           LI   R13,>0005        ; retry count ?

FEE4: 0200 0700           LI   R0,>0700         ; restore command
FEE8: 04C1                CLR  R1
FEEA: 069C                BL   *R12

FEEC: 04C0                CLR  R0               ; store register command
FEEE: 0203 0006           LI   R3,>0006         ; command returns 6 bytes
FEF2: 0204 0200           LI   R4,>0200         ; free area in RAM
FEF6: 069C                BL   *R12
FEF8: C2A4 0004           MOV  @>0004(R4),R10
FEFC: 09BA                SRL  R10,11           ; keep number of track per cylinder (i.e. number of heads)

FEFE: 0200 0400           LI   R0,>0400         ; read unformatted
FF02: 04C2                CLR  R2               ; cylinder 0
FF04: 069C                BL   *R12             ; read track/cylinder address, # of sectors per record, and sector lenght

FF06: C004                MOV  R4,R0            ; >0200 : read data (?)
FF08: D064 0002           MOVB @>0002(R4),R1    ; set the "sectors per records" field
FF0C: C0E4 0004           MOV  @>0004(R4),R3    ; count = sector lenght
FF10: 0A13                SLA  R3,1             ; word count -> byte count
FF12: 069C                BL   *R12             ; read record #0
FF14: C3E4 000E           MOV  @>000E(R4),R15   ; alternate boot program track address
FF18: 890F 0024           C    R15,@>0024(R4)   ; compare with normal program track address
FF1C: 130C                JEQ  >FF36

FF1E: C924 0024 000E      MOV  @>0024(R4),@>000E(R4)    ; replace alternate boot program, with normal one
                                                ; so alternate program will be loaded only once
FF24: 0200 0300           LI   R0,>0300         ; write data
FF28: 069C                BL   *R12             ; write record #0
FF2A: C924 001C 0018      MOV  @>001C(R4),@>0018(R4)    ; use alternate load point
FF30: C924 001E 001A      MOV  @>001E(R4),@>001A(R4)    ; and alternate length

FF36: 0200 0400           LI   R0,>0400         ; read unformatted
FF3A: 0203 0006           LI   R3,>0006         ; command returns 6 bytes
FF3E: 06A0 FF72           BL   @>FF72           ; compute cylinder/head address from track address in R15
FF42: 069C                BL   *R12

FF44: C064 0002           MOV  @>0002(R4),R1    ; set format & sector according to value read from controller
FF48: C004                MOV  R4,R0            ; >0200 : read data
FF4A: 06A0 FF72           BL   @>FF72
FF4E: C3E4 0018           MOV  @>0018(R4),R15   ; program load point
FF52: C0E4 001A           MOV  @>001A(R4),R3    ; program length
FF56: 130A                JEQ  >FF6C            ; fail if null
FF58: 0204 00A0           LI   R4,>00A0         ; free area in RAM ?
FF5C: 069C                BL   *R12             ; read boot program

FF5E: 0200 ABC0           LI   R0,>ABC0         ; magical value ?
FF62: C04E                MOV  R14,R1           ; boot device address
FF64: 04C2                CLR  R2
FF66: D085                MOVB R5,R2            ; unit ID
FF68: 0360                RSET                  ; Reset for things to be cleaner
FF6A: 045F                B    *R15             ; jump to boot program

; exit point when boot program lenght is NULL
FF6C: 0203 D001           LI   R3,>D001         ; load error code

FF70: 102E                JMP  >FFCE            ; stop machine and blink the Fail LED

; compute cylinder & head address from "flat" track address
; input :
; R10 = number of heads
; R15 = track address
; returns :
; R2 = cylinder address
; R0 |= head address
FF72: C24F                MOV  R15,R9
FF74: 04C8                CLR  R8
FF76: 3E0A                DIV  R10,R8           ; compute R15/R10
FF78: C088                MOV  R8,R2            ; R2 = quotient : cylinder address
FF7A: E009                SOC  R9,R0            ; R0 MSB = remainder : head address
FF7C: 045B                B    *R11


; execute some command on a WD900/WT3200 controller
; R0 -> W1 : command and surface register (WD900)
; R1 -> W2 : format and sector (MSByte : sectors per record ; LSByte : sector number) (WD900)
; R2 -> W3 : cylinder address (cylinder number) (WD900) / read offset (WT3200)
; R3 -> W4 : count (length to read/write)
; R4 -> W5 : address (destination/source address to read/write from, 16 LSBits)
; R5 -> W6 : WD900 : select and address (unit selection, 1 bit per unit, in LOW nibble of MSByte, and
;           4 MSBits of address in low nibble of LSByte)
;            WT3200 : command and transport select (unit selection, 1 bit per unit, in HIGH nibble
;           of MSByte, command in high nibble of LSByte, and 4 MSBits of address in low nibble of
;           LSByte)
;
; R14 = controller address
;
; cf 990 Handbook, 5-23, page 188, and WD900/MT3200 general description, chapter 3
;
FF7E: C1CE                MOV  R14,R7           ; TILINE device address
FF80: C227 000E           MOV  @>000E(R7),R8
FF84: 1101                JLT  >FF88
FF86: 10FB                JMP  >FF7E            ; wait for IDLE status bit to be cleared

; write device registers
FF88: 04F7                CLR  *R7+             ; disc status
FF8A: CDC0                MOV  R0,*R7+
FF8C: CDC1                MOV  R1,*R7+
FF8E: CDC2                MOV  R2,*R7+
FF90: CDC3                MOV  R3,*R7+
FF92: CDC4                MOV  R4,*R7+
FF94: CDC5                MOV  R5,*R7+
FF96: 04D7                CLR  *R7              ; controller status

FF98: C217                MOV  *R7,R8
FF9A: 1101                JLT  >FF9E
FF9C: 10FD                JMP  >FF98            ; wait for IDLE controller status bit to be cleared

FF9E: C1C5                MOV  R5,R7
FFA0: 09C7                SRL  R7,12            ; 4 MSBits select unit on WT3200, and are unused on WD900
FFA2: 1603                JNE  >FFAA            ; skip if we are using a tape unit

FFA4: C1DE                MOV  *R14,R7          ; disk status
FFA6: 0A27                SLA  R7,2
FFA8: 18FD                JOC  >FFA4            ; wait for NR (Not Ready) status bit to be cleared

FFAA: 0248 01FF           ANDI R8,>01FF         ; test all individual error bits
FFAE: 1602                JNE  >FFB4            ; jump on error

FFB0: 0700                SETO R0
FFB2: 045B                B    *R11             ; normal return

; error handler :
FFB4: C1DE                MOV  *R14,R7          ; read disk status
FFB6: 11E3                JLT  >FF7E            ; wait for OL (off-line) status bit to be set
FFB8: C1C5                MOV  R5,R7
FFBA: 09C7                SRL  R7,12
FFBC: 1602                JNE  >FFC2            ; skip if we are using a tape unit

FFBE: 060D                DEC  R13
FFC0: 1691                JNE  >FEE4            ; do a few retries before fail ?

FFC2: 0288 0001           CI   R8,>0001         ; check unit error / tape error in controller status
FFC6: 1602                JNE  >FFCC            ; means an error condition is set in disk status / tape transport status
FFC8: 04C8                CLR  R8
FFCA: D21E                MOVB *R14,R8          ; read error code in disk status / tape transport status register

FFCC: C0C8                MOV  R8,R3


; error stop
; we jump to this routine when boot fails
; display R3 for diagnostics purpose, and blink the fail LED.
FFCE: 020C 1FE0           LI   R12,>1FE0
FFD2: 3203                LDCR R3,8
FFD4: 3220 0087           LDCR @>0087,8
FFD8: 1D0B                SBO  >000B
FFDA: 05C1                INCT R1
FFDC: 15FD                JGT  >FFD8
FFDE: 1E0B                SBZ  >000B
FFE0: 10FC                JMP  >FFDA


; spare room
FFE2: 0000                DATA >0000
FFE4: 0000                DATA >0000
FFE6: 0000                DATA >0000
FFE8: 0000                DATA >0000
FFEA: 0000                DATA >0000
FFEC: 0000                DATA >0000
FFEE: 0000                DATA >0000
FFF0: 0000                DATA >0000
FFF2: 0000                DATA >0000
FFF4: 0000                DATA >0000


; pointers to routines
FFF6: FCF4                DATA >FCF4            ; boot loader
FFF8: FCEE                DATA >FCEE            ; ditto
FFFA: FD4A                DATA >FD4A            ; boot loader for MDU (?)

; LOAD vector
FFFC: 0080 FC44           DATA >0080,>FC44










; ROM page 1.

FC00: 020C FE68           LI   R12,>FE68
FC04: 00AC                LCS  R12              ; Load writable Control Store
                                                ; loads microcode to define some XOPs.
FC06: 020C 1FE0           LI   R12,>1FE0
FC0A: 0206 0100           LI   R6,>0100         ; display progress code on programmer panel
FC0E: 3206                LDCR R6,8
FC10: 3220 008D           LDCR @>008D,8

FC14: 0206 0400           LI   R6,>0400
FC18: 0286 0400           CI   R6,>0400
FC1C: 1638                JNE  >FC8E            ; exit on error
FC1E: 0546                INV  R6
FC20: 0286 0400           CI   R6,>0400
FC24: 1334                JEQ  >FC8E            ; exit on error
FC26: 0546                INV  R6
FC28: 02E0 0100           LWPI >0100
FC2C: 02C3                STST R3
FC2E: 0420 FC36           BLWP @>FC36           ; jump

FC32: 0460 FFE0           B    @>FFE0           ; error exit : we should not reach this line

; BLWP vector
FC36: 0120 FC3A           DATA >0120,FC3A

; BLWP routine entry point
FC3A: 02C5                STST R5               ; copy current ST
FC3C: 83C5                C    R5,R15           ; saved ST
FC3E: 1627                JNE  >FC8E            ; should equate
FC40: 028D 0100           CI   R13,>0100        ; old WP
FC44: 1624                JNE  >FC8E
FC46: 028E FC32           CI   R14,>FC32        ; old PC
FC4A: 1621                JNE  >FC8E
FC4C: 020E FC56           LI   R14,>FC56        ; set return PC to >FC56
FC50: 0380                RTWP                  ; return

FC52: 0460 FFE0           B    @>FFE0           ; error exit : we should not reach this line

FC56: 02C4                STST R4               ; restored ST
FC58: 8804 0106           C    R4,@>0106        ; should equate ST before call
FC5C: 1618                JNE  >FC8E

FC5E: 0208 4BF2           LI   R8,>4BF2
FC62: 3A20 FEBA           MPY  @>FEBA,R8        ; times >E819
FC66: 0288 44DA           CI   R8,>44DA         ; test MSWord
FC6A: 1611                JNE  >FC8E
FC6C: 0289 BAA2           CI   R9,>BAA2         ; test LSWord
FC70: 160E                JNE  >FC8E

FC72: 0202 0064           LI   R2,>0064
FC76: 0206 05F5           LI   R6,>05F5
FC7A: 0207 E0FF           LI   R7,>E0FF
FC7E: 3DA2 FE58           DIV  @>FE58(R2),R6    ; divide R6:R7 by @>FEBC = >15CB
FC82: 0286 4604           CI   R6,>4604         ; test quotient
FC86: 1603                JNE  >FC8E
FC88: 0287 07D3           CI   R7,>07D3         ; test remainder
FC8C: 1302                JEQ  >FC92            ; jump if OK

; error exit point
FC8E: 0460 FFE0           B    @>FFE0

FC92: 020A FCDC           LI   R10,>FCDC
FC96: C1A0 FEBE           MOV  @>FEBE,R6        ; -> R6 = >FFFF
FC9A: 04C7                CLR  R7
FC9C: 049A                X    *R10             ; executes a MOVB R6,R7
FC9E: 0287 FF00           CI   R7,>FF00
FCA2: 166A                JNE  >FD78
FCA4: C2A0 FCD6           MOV  @>FCD6,R10       ; >0A59 : SLA R9,5
FCA8: C260 FEBA           MOV  @>FEBA,R9        ; -> R9 = >E819
FCAC: 048A                X    R10              ; executes a SLA R9,5
FCAE: 0289 0320           CI   R9,>0320
FCB2: 1662                JNE  >FD78
FCB4: C220 FEBA           MOV  @>FEBA,R8        ; -> R8 = >E819
FCB8: 04A0 FCD8           X    @>FCD8           ; executes a SRC R8,3
FCBC: 0288 3D03           CI   R8,>3D03
FCC0: 165B                JNE  >FD78
FCC2: 0205 0032           LI   R5,>0032
FCC6: C120 FEBA           MOV  @>FEBA,R4        ; -> R4 = >E819
FCCA: 04A5 FCA8           X    @>FCA8(R5)       ; executes "INV  R4" at @>FCDA
FCCE: 0284 17E6           CI   R4,>17E6
FCD2: 1652                JNE  >FD78
FCD4: 1004                JMP  >FCDE

; instruction table
FCD6: 0A59                SLA  R9,5
FCD8: 0B38                SRC  R8,3
FCDA: 0544                INV  R4
FCDC: D1C6                MOVB R6,R7

; test, next part
FCDE: 0205 0135           LI   R5,>0135
FCE2: C560 FEB8           MOV  @>FEB8,*R5       ; moves >1234 at address @>0134 (address LSBit ignored)
FCE6: 0206 0015           LI   R6,>0015
FCEA: 0203 FEAA           LI   R3,>FEAA         ; empty (i.e. all-0s) map file
FCEE: 0323                LMF  R3,0             ; load as memory map
FCF0: 020C 1FA0           LI   R12,>1FA0
FCF4: 1D03                SBO  >0003            ; change RAM set-up ?
FCF6: 07A0 FEA6           LDS  @>FEA6           ; this temporary memory map -> >120 offset on next source address
FCFA: C816 017E           MOV  *R6,@>017E       ; i.e. we actually read @>0009A * 2 = @>000134
FCFE: 8820 017E FEB8      C    @>017E,@>FEB8
FD04: 16C4                JNE  >FC8E
FD06: 07E0 FEA6           LDD  @>FEA6           ; same story with destination
FD0A: C5A0 FEBA           MOV  @>FEBA,*R6
FD0E: 8560 FEBA           C    @>FEBA,*R5
FD12: 16BD                JNE  >FC8E
FD14: C820 FEBE 017A      MOV  @>FEBE,@>017A    ; @>017A = >FFFF
FD1A: 0706                SETO R6
FD1C: 0066 5820 FEB8 0176 MOVS R6,@>FEB8,@>0176,5   ; move 5 bytes
FD24: 0706                SETO R6
FD26: 0046 5820 FEB8 0176 CS   R6,@>FEB8,@>0176,5
FD2E: 1624                JNE  >FD78
FD30: 9820 017B FEBE      CB   @>017B,@>FEBE    ; check we did not write an extra byte
FD36: 1620                JNE  >FD78

FD38: 04C0                CLR  R0
FD3A: C820 FEB8 0176      MOV  @>FEB8,@>0176
FD40: 0E00 0020 0176      IOF  R0,@>0176 (?)    ; Invert Order of Field
FD46: 8820 0176 FEB6      C    @>0176,@>FEB6
FD4C: 1615                JNE  >FD78
FD4E: 8820 FEB8 FEB8      C    @>FEB8,@>FEB8    ; should set Equal bit
FD54: 02C3                STST R3
FD56: 0202 2000           LI   R2,>2000
FD5A: 20C2                COC  R2,R3            ; (R2 & R3) == R2 ?
FD5C: 160D                JNE  >FD78
FD5E: 0202 C000           LI   R2,>C000
FD62: 24C2                CZC  R2,R3            ; (R2 & ~R3) == R2 ?
FD64: 1609                JNE  >FD78
FD66: 8820 FEBE FEAA      C    @>FEBE,@>FEAA
FD6C: 02C7                STST R7
FD6E: 0247 E000           ANDI R7,>E000
FD72: 0287 8000           CI   R7,>8000         ; H == 1, G & E == 0
FD76: 1302                JEQ  >FD7C            ; jump if OK

; error exit point
FD78: 0460 FFE0           B    @>FFE0

FD7C: 0023 2820 FE92 0176 BDC  @>FE92,@>0176,2  ; Binary to Decimal ascii conversion
FD84: 8820 0176 FE94      C    @>0176,@>FE94    ; test first 2 chars
FD8A: 16F6                JNE  >FD78
FD8C: 8820 0178 FE96      C    @>0178,@>FE96    ; test last 2 chars
FD92: 16F2                JNE  >FD78
FD94: 0706                SETO R6
FD96: 0046 4820 0176 FE94 CS   R6,@>0176,@>FE94,4   ; compare string
FD9E: 16EC                JNE  >FD78
FDA0: 05A0 0178           INC  @>0178           ; alter last char
FDA4: 0706                SETO R6
FDA6: 0046 4820 0176 FE94 CS   R6,@>0176,@>FE94,4   ; compare string
FDAE: 13E4                JEQ  >FD78            ; should be different
FDB0: 0286 0003           CI   R6,>0003         ; first different char is third char (?)
FDB4: 16E1                JNE  >FD78
FDB6: 0024 2820 FE94 0176 DBC  @>FE94,@>0176,2  ; Decimal ascii to Binary conversion
FDBE: 8820 FE92 0176      C    @>FE92,@>0176
FDC4: 16D9                JNE  >FD78
FDC6: 0CA0 FE98           CIR  @>FE98           ; Convert Integer to Real
FDCA: 0706                SETO R6
FDCC: 0046 4800 FE9E      CS   R6,R0,@>FE9E,4
FDD2: 16D2                JNE  >FD78
FDD4: 0CE0 FE9A           SR   @>FE9A
FDD8: 0C00                CRI
FDDA: 0280 0BB8           CI   R0,>0BB8
FDDE: 16CC                JNE  >FD78
FDE0: 0C2A 30A0 FEBA      XV   10,@>FEBA,R2,3   ; extract 10 bits from bit 3 in @>FEBA, store result in R2 (?)
FDE6: 0282 0103           CI   R2,>0103
FDEA: 16C6                JNE  >FD78
FDEC: C820 FEBA 0176      MOV  @>FEBA,@>0176
FDF2: C820 FEBC 0178      MOV  @>FEBC,@>0178    ; load >E81915CB
FDF8: 001C 3160 0176      SRAM @>0176,5,3       ; shift 3 bytes at @>0176 with 5 bits
FDFE: 17BC                JNC  >FD78
FE00: 0706                SETO R6
FE02: 0046 4820 FEA2 0176 CS   R6,@>FEA2,@>0176,4   ; >FF40C8CB
FE0A: 16B6                JNE  >FD78
FE0C: 0205 C7CB           LI   R5,>C7CB
FE10: 9805 FEA4           CB   R5,@>FEA4
FE14: 13B1                JEQ  >FD78
FE16: 0207 C8AB           LI   R7,>C8AB
FE1A: 9807 FEA4           CB   R7,@>FEA4
FE1E: 16AC                JNE  >FD78
FE20: 02A5                STWP R5
FE22: 0285 0100           CI   R5,>0100
FE26: 16A8                JNE  >FD78
FE28: C0E0 FEBC           MOV  @>FEBC,R3        ; >15CB
FE2C: 0200 AC0F           LI   R0,>AC0F         ; - >53F1
FE30: 01C3                MPYS R3
FE32: 0706                SETO R6
FE34: 0046 4800 FE6E      CS   R6,R0,@>FE6E,4   ; >F8DAAAE5 = - >0725551B
FE3A: 169E                JNE  >FD78
FE3C: 0709                SETO R9
FE3E: 0069 8020 FE72      MOVS R9,@>FE72,R0,8   ; >4226000000000000
FE44: 0F60 FE82           DD   @>FE82           ; Divide Double-precision >C234000000000000
FE48: 0706                SETO R6
FE4A: 0046 8800 FE7A      CS   R6,R0,@>FE7A,8   ; >C0BB13B13B13B13B
FE50: 1693                JNE  >FD78
FE52: 0706                SETO R6
FE54: 0066 8020 FE8E      MOVS R6,@>FE8E,R0,8
FE5A: 0C05                CDE                   ; convert double to extended (i.e. 32-bit) int
FE5C: 070A                SETO R10
FE5E: 004A 4800 FE8A      CS   R10,R0,@>FE8A,4  ; >FFA63E0D
FE64: 1689                JNE  >FD78
FE66: 102C                JMP  >FEC0

; various tables
; table used by LCS.  Too short to be complete microcoded instructions I guess, so these must be
; pointers.
FE68: 0020                DATA >0020
FE6A: 0BE0                DATA >0BE0
FE6C: 0100                DATA >0100

FE6E: F8DA AAE5           DATA >F8DA,>AAE5      ; signed 4-byte int
; 64-bit floats
FE72: 4226 0000 0000 0000 DATA >4226,>0000,>0000,>0000
FE7A: C0BB 13B1 3B13 B13B DATA >C0BB,>13B1,>3B13,>B13B
FE82: C234 0000 0000 0000 DATA >C234,>0000,>0000,>0000
FE8A: FFA6 3E0D           DATA >FFA6,>3E0D
FE8E: C659                DATA >C659
FE90: C1F3                DATA >C1F3
FE92: 03CF                DATA >03CF            ; 975
FE94: 3937 352B           BYTE '9','7','5','+'
FE98: 2710                DATA >2710
FE9A: 441B                DATA >441B
FE9C: 5800                DATA >5800
FE9E: 4427 1000           DATA >4427,>1000      ; single-precision real
FEA2: FF40 C8CB           DATA >FF40,>C8CB

; simple memory map : adds a 9*32 = >120 offset to every address
FEA6: 0000                DATA >0000
FEA8: 0009                DATA >0009

; empty memory map
FEAA: 0000                DATA >0000
FEAC: 0000                DATA >0000
FEAE: 0000                DATA >0000
FEB0: 0000                DATA >0000
FEB2: 0000                DATA >0000
FEB4: 0000                DATA >0000

FEB6: 2C48                DATA >2C48            ; >1234 reversed

FEB8: 1234                DATA >1234
FEBA: E819                DATA >E819
FEBC: 15CB                DATA >15CB
FEBE: FFFF                DATA >FFFF

FEC0: 001D 2060 008C      SLAM @>008C,1,2       ; update progress code in R6, Workspace >0080

FEC6: 0700                SETO R0
FEC8: 0202 FEFF           LI   R2,>FEFF
FECC: 0204 EFFF           LI   R4,>EFFF
FED0: 04C6                CLR  R6
FED2: 04C7                CLR  R7
FED4: 04C8                CLR  R8
FED6: 04C9                CLR  R9
FED8: 04CA                CLR  R10
FEDA: 02CC                STST R12
FEDC: 026C 0010           ORI  R12,>0010        ; enable writable control store to use custom XOP
FEE0: 008C                LST  R12
FEE2: 020C 1FA0           LI   R12,>1FA0
FEE6: 1E03                SBZ  >0003

; map test loop start
FEE8: C067 FFA8           MOV  @>FFA8(R7),R1    ; first table
FEEC: C0E7 FFB0           MOV  @>FFB0(R7),R3    ; second table
FEF0: C167 FFB8           MOV  @>FFB8(R7),R5    ; third table
FEF4: 02E0 0120           LWPI >0120
FEF8: 020B 0100           LI   R11,>0100
FEFC: 032B                LMF  R11,0            ; previous R0-R5 -> map file
FEFE: 02E0 0100           LWPI >0100

FF02: C226 FFC0           MOV  @>FFC0(R6),R8    ; load address we want to test from table
FF06: C249                MOV  R9,R9
FF08: C28A                MOV  R10,R10
FF0A: 2C40                XOP  R0,1             ; this instruction must be defined by LCS.
; result : 16 LSBs of address in R9, 4 MSBs of address in 4 MSBs of R10 (all reversed and inverted)
; 4 next bits of R10 seem to be an index in the map table (????)
FF0C: 100A                JMP  >FF22


; loop test (we increment, and either loop or exit)
FF0E: 05C7                INCT R7               ; try another map file
FF10: 0287 0008           CI   R7,>0008
FF14: 11E9                JLT  >FEE8

FF16: 05C6                INCT R6               ; try another address to test mapping
FF18: 04C7                CLR  R7
FF1A: 0286 001E           CI   R6,>001E
FF1E: 11E4                JLT  >FEE8

FF20: 1062                JMP  >FFE6            ; exit OK to next test on next ROM page


; map test loop (continued)
FF22: C30A                MOV  R10,R12
FF24: 04C0                CLR  R0
FF26: 0E00 000C           IOF  R0,R12
FF2A: 054C                INV  R12
FF2C: 024C 000F           ANDI R12,>000F        ; R12 = address 4 MSB
FF30: 0E00 0009           IOF  R0,R9
FF34: 0549                INV  R9               ; R9 = address 16 LSB
FF36: 0540                INV  R0
FF38: 098A                SRL  R10,8
FF3A: 024A 000F           ANDI R10,>000F

FF3E: 0288 0100           CI   R8,>0100         ; does B2 apply ?
FF42: 150F                JGT  >FF62
; case R8 < >0100
FF44: 028A 0006           CI   R10,>0006        ; -> a >9 reversed and inverted ???
FF48: 162D                JNE  >FFA4            ; error...
FF4A: C2C1                MOV  R1,R11
FF4C: 09CB                SRL  R11,12
FF4E: 830B                C    R11,R12          ; compare 4 MSBs of address
FF50: 1629                JNE  >FFA4
FF52: C2C1                MOV  R1,R11
FF54: 0A4B                SLA  R11,4
FF56: C308                MOV  R8,R12
FF58: 091C                SRL  R12,1
FF5A: A2CC                A    R12,R11
FF5C: 824B                C    R11,R9           ; compare 16 LSBs of address
FF5E: 1622                JNE  >FFA4
FF60: 10D6                JMP  >FF0E            ; loop

FF62: 0288 1000           CI   R8,>1000         ; does B3 apply ?
FF66: 150F                JGT  >FF86

FF68: 028A 000A           CI   R10,>000A        ; -> a >A reversed and inverted ???
FF6C: 161B                JNE  >FFA4
FF6E: C2C3                MOV  R3,R11
FF70: 09CB                SRL  R11,12
FF72: 830B                C    R11,R12
FF74: 1617                JNE  >FFA4
FF76: C2C3                MOV  R3,R11
FF78: 0A4B                SLA  R11,4
FF7A: C308                MOV  R8,R12
FF7C: 091C                SRL  R12,1
FF7E: A2CC                A    R12,R11
FF80: 824B                C    R11,R9
FF82: 1610                JNE  >FFA4
FF84: 10C4                JMP  >FF0E            ; loop

; no Bn bias register apply
FF86: 028A 000C           CI   R10,>000C        ; -> a >C reversed and inverted ???
FF8A: 160C                JNE  >FFA4
FF8C: C2C5                MOV  R5,R11
FF8E: 09CB                SRL  R11,12
FF90: 830B                C    R11,R12
FF92: 1608                JNE  >FFA4
FF94: C2C5                MOV  R5,R11
FF96: 0A4B                SLA  R11,4
FF98: C308                MOV  R8,R12
FF9A: 091C                SRL  R12,1
FF9C: A2CC                A    R12,R11
FF9E: 824B                C    R11,R9
FFA0: 1601                JNE  >FFA4
FFA2: 10B5                JMP  >FF0E

; error exit  point
FFA4: 0460 FFE0           B    @>FFE0

; map file table start
; L1, L2 & L3 are a fixed >FFFF, FEFF, EFFF (-> addresses >0000, >0100, >1000)
; B1
FFA8: 1111                DATA >1111
FFAA: 2222                DATA >2222
FFAC: 4444                DATA >4444
FFAE: 8888                DATA >8888
; B2
FFB0: 1109                DATA >1109
FFB2: 221A                DATA >221A
FFB4: 443C                DATA >443C
FFB6: 8880                DATA >8880
; B3
FFB8: 1091                DATA >1091
FFBA: 21A2                DATA >21A2
FFBC: 43C4                DATA >43C4
FFBE: 8808                DATA >8808

; table with addresses we want to test
FFC0: 000E                DATA >000E
FFC2: 0016                DATA >0016
FFC4: 001A                DATA >001A
FFC6: 001C                DATA >001C
FFC8: 001E                DATA >001E
FFCA: 010E                DATA >010E
FFCC: 0116                DATA >0116
FFCE: 011A                DATA >011A
FFD0: 011C                DATA >011C
FFD2: 011E                DATA >011E
FFD4: 100E                DATA >100E
FFD6: 1016                DATA >1016
FFD8: 101A                DATA >101A
FFDA: 101C                DATA >101C
FFDC: 101E                DATA >101E

FFDE: 0300                DATA >0300

; error exit (cross-page jump)
FFE0: 0205 FFE6           LI   R5,>FFE6
FFE4: 1002                JMP  >FFEA

; normal exit (cross-page jump)
FFE6: 0205 FC00           LI   R5,>FC00

FFEA: 0204 0200           LI   R4,>0200
FFEE: 020C 1FB4           LI   R12,>1FB4
FFF2: 30C4                LDCR R4,3             ; switch to page 2 ?
FFF4: 0455                B    *R5

FFF6: FFFF                DATA >FFFF
FFF8: FFFF                DATA >FFFF
FFFA: FFFF                DATA >FFFF
FFFC: FFFF                DATA >FFFF
FFFE: FFFF                DATA >FFFF










; ROM page 2.

FC00: 0206 0400           LI   R6,>0400
FC04: C806 008C           MOV  R6,@>008C
FC08: 0201 1234           LI   R1,>1234
FC0C: C801 0176           MOV  R1,@>0176
FC10: 0201 E819           LI   R1,>E819
FC14: C801 0178           MOV  R1,@>0178
FC18: 002A 4820 FC56 0176 SM   @>FC56,@>0176,4
FC20: 0706                SETO R6
FC22: 0046 4820 FC5A 0176 CS   R6,@>FC5A,@>0176,4
FC2A: 1613                JNE  >FC52
FC2C: 0208 ABCD           LI   R8,>ABCD
FC30: 0209 EF59           LI   R9,>EF59
FC34: 0028 3220 FC56      ANDM @>FC56,R8,3
FC3A: 0027 3220 FC5A      ORM  @>FC5A,R8,3
FC40: 0026 3220 FC5E      XORM @>FC5E,R8,3
FC46: 0288 1215           CI   R8,>1215
FC4A: 1603                JNE  >FC52
FC4C: 0289 0359           CI   R9,>0359
FC50: 130A                JEQ  >FC66
FC52: 0460 FFE6           B    @>FFE6

FC56: 4816 5800           DATA >4816,>5800
FC5A: 5A4B 4019           DATA >5A4B,>4019
FC5E: 485A 4B40           DATA >485A,>4B40
FC62: 1900                DATA >1900
FC64: 0000                DATA >0000

; memory test
FC66: 001D 20A0 008C      SLAM @>008C,2,2       ; update progress code

FC6C: 04C5                CLR  R5
FC6E: 04C6                CLR  R6
FC70: 02A4                STWP R4
FC72: C044                MOV  R4,R1
FC74: 0221 000A           AI   R1,>000A         ; R1 points to R5
FC78: 0202 FCEE           LI   R2,>FCEE
FC7C: 020C 1FA0           LI   R12,>1FA0
FC80: 04C3                CLR  R3
FC82: 0322                LMF  R2,0             ; map file loaded is empty, I think
FC84: 1D03                SBO  >0003

; test loop
FC86: 0286 0000           CI   R6,>0000
FC8A: 161E                JNE  >FCC8
FC8C: 0283 F800           CI   R3,>F800
FC90: 141F                JHE  >FCD0            ; cannot test >F800->FFFF (always maps to TILINE and ROM)
FC92: 8103                C    R3,R4
FC94: 1602                JNE  >FC9A
FC96: 0223 0020           AI   R3,>0020         ; do not overwrite our workspace...

FC9A: 0791                LDS  *R1
FC9C: C013                MOV  *R3,R0           ; save * (R6:R3)
FC9E: 07D1                LDD  *R1
FCA0: C4E0 FCF2           MOV  @>FCF2,*R3       ; write >AAAA to * (R6:R3)
FCA4: 0791                LDS  *R1
FCA6: 8813 FCF2           C    *R3,@>FCF2
FCAA: 1616                JNE  >FCD8            ; exit in error if different
FCAC: 0791                LDS  *R1
FCAE: 0553                INV  *R3
FCB0: 0791                LDS  *R1
FCB2: 8813 FCF4           C    *R3,@>FCF4       ; compare with >5555 = ~ >AAAA
FCB6: 1610                JNE  >FCD8
FCB8: 07D1                LDD  *R1
FCBA: CCC0                MOV  R0,*R3+          ; restore * (R6:R3), and increment R3
FCBC: 0283 0000           CI   R3,>0000
FCC0: 16E2                JNE  >FC86            ; loop if R3 has not wrapped around to 0
FCC2: 0226 0800           AI   R6,>0800         ; else fix bias (B1) for LDS/LDD to point to next 64kb
FCC6: 10DF                JMP  >FC86            ; and loop

FCC8: 0286 1000           CI   R6,>1000         ; jump here if R6 != 0
FCCC: 11E6                JLT  >FC9A            ; continue if not testing address over >020000 (>10000)
FCCE: 1013                JMP  >FCF6            ; else exit

FCD0: 0226 0800           AI   R6,>0800         ; skip system area (TPCS and ROM)
FCD4: 04C3                CLR  R3               ; and jump to >010000 (>08000)
FCD6: 10E1                JMP  >FC9A

; error exit :
FCD8: 07D1                LDD  *R1
FCDA: C4C0                MOV  R0,*R3           ; try to restore memory data
FCDC: C803 0094           MOV  R3,@>0094        ; save current address
FCE0: 09B6                SRL  R6,11
FCE2: C806 0090           MOV  R6,@>0090        ; save address MSBits.
FCE6: 0A33                SLA  R3,3
FCE8: 1306                JEQ  >FCF6            ; if we are on a 8 kbyte boundary, we must have only
                                                ; reached end of memory, so we jump to normal exit
FCEA: 0460 FFE6           B    @>FFE6           ; exit in error to next page

; empty map file
FCEE: 0000 0000           DATA >0000,>0000      ; L1 = ~ >FFFF, B1 = >0000
FCF2: AAAA 5555           DATA >AAAA,>5555      ; L2 = ~ >5555, B2 = >5555

; Memory test exit point
; Error interrupt test
; The CPU triggers a level-2 interrupt on some error conditions : unimplemented memory,
; illegal instructions, overflow...
FCF6: 001D 2060 008C      SLAM 2,@>008C,1       ; update progress code

FCFC: 020C 1FC0           LI   R12,>1FC0
FD00: 04C1                CLR  R1
FD02: 3001                LDCR R1,16

; save current interrupt vectors to >0180
FD04: 0202 0180           LI   R2,>0180
FD08: CCB1                MOV  *R1+,*R2+
FD0A: 0281 0040           CI   R1,>0040
FD0E: 11FC                JLT  >FD08

; set all int vectors to default spurious int handler
FD10: 04C1                CLR  R1
FD12: 0202 0100           LI   R2,>0100
FD16: 0203 FFE2           LI   R3,>FFE2
FD1A: CC42                MOV  R2,*R1+
FD1C: CC43                MOV  R3,*R1+
FD1E: 0281 0040           CI   R1,>0040
FD22: 11FB                JLT  >FD1A

; test timeout error
FD24: 0201 FD38           LI   R1,>FD38
FD28: C801 000A           MOV  R1,@>000A        ; set int 2 routine
FD2C: 0300 0002           LIMI >0002            ; allow int 2 (machine error)
FD30: C060 FBFE           MOV  @>FBFE,R1        ; no memory there -> timeout error
FD34: 0460 FFE2           B    @>FFE2           ; error exit

; int 2 routine
FD38: 0200 8000           LI   R0,>8000         ; bit 0 = timeout bit
FD3C: 06A0 FFC8           BL   @>FFC8           ; clear
; test priviledge violation error
FD40: 0201 FD5C           LI   R1,>FD5C
FD44: C801 000A           MOV  R1,@>000A
FD48: 0300 0002           LIMI >0002            ; allow int 2
FD4C: 02C1                STST R1
FD4E: 0261 0100           ORI  R1,>0100         ; set ST_PR bit
FD52: 0081                LST  R1               ; -> switch to user mode
FD54: 0300 0002           LIMI >0002            ; should trigger a priviledge violation error
FD58: 0460 FFE2           B    @>FFE2

; int 2 routine
FD5C: 0200 4000           LI   R0,>4000         ; bit 1 = priviledge violation
FD60: 06A0 FFC8           BL   @>FFC8
; test illegal opcode error
FD64: 0201 FD76           LI   R1,>FD76
FD68: C801 000A           MOV  R1,@>000A
FD6C: 0300 0002           LIMI >0002            ; allow int 2
FD70: 0000                DATA >0000            ; illegal instruction
FD72: 0460 FFE2           B    @>FFE2           ; exit in error

; int 2 routine
FD76: 0200 2000           LI   R0,>2000         ; bit 2 = illegal instruction
FD7A: 06A0 FFC8           BL   @>FFC8
; test memory parity error
FD7E: 0201 FD9A           LI   R1,>FD9A
FD82: C801 000A           MOV  R1,@>000A
FD86: 020C 1FA0           LI   R12,>1FA0
FD8A: 1D09                SBO  >0009            ; enable parity checking ?
FD8C: 0300 0002           LIMI >0002
FD90: C060 FC00           MOV  @>FC00,R1        ; obviously triggers a parity error - why ?
FD94: 1E09                SBZ  >0009
FD96: 0460 FFE2           B    @>FFE2

FD9A: 1E09                SBZ  >0009
FD9C: 0200 1000           LI   R0,>1000         ; bit 3 = Memory parity error
FDA0: 06A0 FFC8           BL   @>FFC8
; test address beyond map error
FDA4: 0201 FDE4           LI   R1,>FDE4
FDA8: C801 000A           MOV  R1,@>000A
FDAC: 0202 0000           LI   R2,>0000
FDB0: 0542                INV  R2               ; L1 = ~ >0000
FDB2: 04C3                CLR  R3               ; B1 = 0
FDB4: 0204 EFFE           LI   R4,>EFFE
FDB8: 0544                INV  R4               ; L2 = ~ >EFFE
FDBA: 04C5                CLR  R5               ; B2 = 0
FDBC: 0206 0000           LI   R6,>0000
FDC0: 0546                INV  R6               ; L3 = ~ >0000 (-> will be ignored)
FDC2: 04C7                CLR  R7               ; B3 = 0
FDC4: 02A1                STWP R1
FDC6: 0221 0004           AI   R1,>0004         ; points to R2
FDCA: 0321                LMF  R1,0             ; load map file
FDCC: 020C 1FA0           LI   R12,>1FA0
FDD0: 1D03                SBO  >0003
FDD2: 0300 0000           LIMI >0000
FDD6: C060 F020           MOV  @>F020,R1        ; address not defined in memory map
FDDA: 1E03                SBZ  >0003
FDDC: 0300 0002           LIMI >0002
FDE0: 0460 FFE2           B    @>FFE2

FDE4: 1E03                SBZ  >0003
FDE6: 0200 8800           LI   R0,>8800         ; bits 0 and 4 = timeout & Address beyond map bits
FDEA: 06A0 FFC8           BL   @>FFC8
; test memory protection
FDEE: 0201 FE30           LI   R1,>FE30
FDF2: C801 000A           MOV  R1,@>000A
FDF6: 0702                SETO R2               ; L1 = ~ >0000
FDF8: 04C3                CLR  R3               ; B1 = 0
FDFA: 0204 FEE2           LI   R4,>FEE2         ; L2 = ~ (>0100 | >1D) (5 LSBits ignored for address
                                                ; - must tell the memory is execution protected)
                                                ; B2 in R5 should still be 0, but maybe we don't care
FDFE: 04C6                CLR  R6               ; L3 = ~ >FFFF
FE00: 04C7                CLR  R7               ; B3 = 0
FE02: 02A1                STWP R1
FE04: 0221 0004           AI   R1,>0004
FE08: 0321                LMF  R1,0             ; load map file
FE0A: 020C 1FA0           LI   R12,>1FA0
FE0E: 1D03                SBO  >0003
FE10: 0200 1000           LI   R0,>1000         ; NOP instruction
FE14: 02C1                STST R1
FE16: 0261 0040           ORI  R1,>0040         ; memory management bit
FE1A: 0081                LST  R1
FE1C: 0300 0002           LIMI >0002
FE20: 04A0 0100           X    @>0100           ; actually executes NOP in R0, I think
FE24: 1E03                SBZ  >0003
FE26: 0241 FFB1           ANDI R1,>FFB1         ; clear memory management bit
FE2A: 0081                LST  R1
FE2C: 0460 FFE2           B    @>FFE2

FE30: 1E03                SBZ  >0003
FE32: 0241 FFB1           ANDI R1,>FFB1
FE36: 0081                LST  R1
FE38: 0200 0200           LI   R0,>0200         ; bit 6 : execution in execute-protected memory
FE3C: 06A0 FFC8           BL   @>FFC8
FE40: 0201 FE82           LI   R1,>FE82
FE44: C801 000A           MOV  R1,@>000A
FE48: 0702                SETO R2               ; L1 = ~ >0000
FE4A: 04C3                CLR  R3
FE4C: 0204 FEE1           LI   R4,>FEE1         ; L2 = ~ (>0100 | >1E) (must tell memory is write-protected)
FE50: 04C5                CLR  R5
FE52: 04C6                CLR  R6
FE54: 04C7                CLR  R7
FE56: 02A1                STWP R1
FE58: 0221 0004           AI   R1,>0004
FE5C: 0321                LMF  R1,0
FE5E: 020C 1FA0           LI   R12,>1FA0
FE62: 1D03                SBO  >0003
FE64: 02C1                STST R1
FE66: 0261 0040           ORI  R1,>0040         ; memory management bit
FE6A: 0081                LST  R1
FE6C: 0300 0002           LIMI >0002
FE70: C820 00E0 0100      MOV  @>00E0,@>0100
FE76: 1E03                SBZ  >0003
FE78: 0241 FFB1           ANDI R1,>FFB1
FE7C: 0081                LST  R1
FE7E: 0460 FFE2           B    @>FFE2

FE82: 1E03                SBZ  >0003
FE84: 0241 FFB1           ANDI R1,>FFB1
FE88: 0081                LST  R1
FE8A: 0200 0100           LI   R0,>0100         ; bit 7 : write in write-protected memory
FE8E: 06A0 FFC8           BL   @>FFC8
FE92: 0201 FEB2           LI   R1,>FEB2
FE96: C801 000A           MOV  R1,@>000A
FE9A: 0703                SETO R3
FE9C: 0300 0002           LIMI >0002
FEA0: 00D3 6820 FEAC 0100 MVSK R3,@>FEAC,@>0100,6   ; move string from stack - whatever it does
                                                    ; distinct from POPS - POP String from stack
FEA8: 0460 FFE2           B    @>FFE2

; MAYBE the data that follow is a stack descriptor.
; Anyway, we need something like this, since I can't see any place where we set up a SP and
; stack bounds.  Maybe these are hard-coded, but why should MVSK take 2 operands, then ?
FEAC: 0102                DATA >0102                ; current stack pointer ?
FEAE: 0100                DATA >0100                ; stack bottom ? (or stack growth limit ?)
FEB0: 0104                DATA >0104                ; stack growth limit ? (or stack bottom ?)


FEB2: 0200 0080           LI   R0,>0080         ; bit 8 : stack overflow
FEB6: 06A0 FFC8           BL   @>FFC8
FEBA: 0201 FF2A           LI   R1,>FF2A
FEBE: C801 000A           MOV  R1,@>000A
FEC2: 04C1                CLR  R1
FEC4: 0202 FCEE           LI   R2,>FCEE         ; points on empty map file
FEC8: 0322                LMF  R2,0             ; load both map files
FECA: 0332                LMF  R2,1

; test loop entry point
FECC: 0281 000E           CI   R1,>000E         ; index from >0*2 to >7*2
FED0: 1542                JGT  >FF56            ; exit loop if greater
FED2: C0E1 FF36           MOV  @>FF36(R1),R3    ; read breakpoint generator operation mode ?
FED6: 020C 1FAA           LI   R12,>1FAA
FEDA: 30C3                LDCR R3,3
FEDC: 0203 0101           LI   R3,>0101         ; breakpoint address, I guess - LSBit meaning unknown
FEE0: 020C 1F80           LI   R12,>1F80
FEE4: 3003                LDCR R3,16
FEE6: 02C2                STST R2
FEE8: 0281 0008           CI   R1,>0008
FEEC: 1103                JLT  >FEF4

FEEE: 0262 0080           ORI  R2,>0080         ; -> use map file 1
FEF2: 1002                JMP  >FEF8

FEF4: 0242 FF7F           ANDI R2,>FF7F         ; -> use map file 0

FEF8: 0082                LST  R2               ; write in ST
FEFA: 0300 0002           LIMI >0002
FEFE: C0A1 FF46           MOV  @>FF46(R1),R2    ; load test routine address
FF02: 020C 1FA0           LI   R12,>1FA0
FF06: 1D03                SBO  >0003
FF08: 0452                B    *R2              ; jump

FF0A: C820 0100 0104      MOV  @>0100,@>0104    ; read from >0100
FF10: 0460 FFE2           B    @>FFE2

FF14: 0200 1000           LI   R0,>1000         ; NOP
FF18: 04A0 0100           X    @>0100           ; execute at >0100
FF1C: 0460 FFE2           B    @>FFE2

FF20: C820 0104 0100      MOV  @>0104,@>0100    ; write to >0100
FF26: 0460 FFE2           B    @>FFE2


FF2A: 0200 0040           LI   R0,>0040         ; breakpoint address encountered ?
FF2E: 06A0 FFC8           BL   @>FFC8
FF32: 05C1                INCT R1
FF34: 10CB                JMP  >FECC

; table 1 for test loop : breakpoint mode ?
FF36: 0000                DATA >0000            ; break on read, map file 0 ?
FF38: 0400                DATA >0400            ; break on execute ?
FF3A: 0200                DATA >0200            ; break on write ?
FF3C: 0600                DATA >0600            ; ???
FF3E: 0100                DATA >0100            ; same as above with map file 1 ?
FF40: 0500                DATA >0500
FF42: 0300                DATA >0300
FF42: 0700                DATA >0700
; table 2 for test loop : test code
FF46: FF0A                DATA >FF0A            ; read
FF48: FF14                DATA >FF14            ; execute
FF4A: FF20                DATA >FF20            ; write
FF4C: FF0A                DATA >FF0A            ; read
FF4E: FF0A                DATA >FF0A
FF50: FF14                DATA >FF14
FF52: FF20                DATA >FF20
FF54: FF0A                DATA >FF0A


FF56: 020C 1FA0           LI   R12,>1FA0
FF5A: 1E03                SBZ  >0003
; clock test
FF5C: 0201 FF7E           LI   R1,>FF7E
FF60: C801 000A           MOV  R1,@>000A
FF64: 020C 1FA0           LI   R12,>1FA0
FF68: 0300 0002           LIMI >0002
FF6C: 0202 1C00           LI   R2,>1C00
FF70: 1D01                SBO  >0001            ; enable clock ?
FF72: 0602                DEC  R2               ; wait for clock to trigger
FF74: C082                MOV  R2,R2            ; this loop should execute in about 12ms
FF76: 15FD                JGT  >FF72            ; more than 1500000  instructions per second - not so bad
FF78: 1E01                SBZ  >0001
FF7A: 0460 FFE2           B    @>FFE2


FF7E: 1E01                SBZ  >0001
FF80: 0200 0020           LI   R0,>0020         ; 12ms test clock
FF84: 06A0 FFC8           BL   @>FFC8
; arithmetic overflow interrupt test
FF88: 0201 FFA8           LI   R1,>FFA8
FF8C: C801 000A           MOV  R1,@>000A
FF90: 0201 7FFF           LI   R1,>7FFF
FF94: C081                MOV  R1,R2
FF96: 0300 0002           LIMI >0002
FF9A: 02C3                STST R3
FF9C: 0263 0020           ORI  R3,>0020         ; arithmetic overflow enable
FFA0: 0083                LST  R3
FFA2: A081                A    R1,R2            ; >7FFF + >7FFF = >FFFE, and overflow bit is set
FFA4: 0460 FFE2           B    @>FFE2


FFA8: 0243 F7D1           ANDI R3,>F7D1
FFAC: 0083                LST  R3
FFAE: 0200 0010           LI   R0,>0010         ; arithmetic overflow bit
FFB2: 06A0 FFC8           BL   @>FFC8
FFB6: 101A                JMP  >FFEC            ; exit OK to next page

FFB8: 04C1                CLR  R1
FFBA: 0202 0180           LI   R2,>0180
FFBE: CC72                MOV  *R2+,*R1+
FFC0: 0281 0040           CI   R1,>0040
FFC4: 11FC                JLT  >FFBE
FFC6: 045B                B    *R11

; This routine checks that R0 matches the error interrupt register.
FFC8: 020C 1FC0           LI   R12,>1FC0
FFCC: 3401                STCR R1,16            ; read error interrupt register
FFCE: 0241 FFFE           ANDI R1,>FFFE         ; clear system type indicator ?
FFD2: 04C3                CLR  R3
FFD4: 3003                LDCR R3,16            ; clear error interrupt register
FFD6: C0C0                MOV  R0,R3
FFD8: 0027 20C1           ORM  R1,R3,2
FFDC: 80C0                C    R0,R3            ; are there extra error bits ?
FFDE: 1601                JNE  >FFE2            ; if so, exit in error
FFE0: 045B                B    *R11

; spurious interrupt handler, and error exit handler for the error interrupt test
; restore vectors, then jump to next page in error
FFE2: 06A0 FFB8           BL   @>FFB8

; jump to next page in error
FFE6: 0205 FE20           LI   R5,>FE20
FFEA: 1002                JMP  >FFF0
; jump to next page OK
FFEC: 0205 FC00           LI   R5,>FC00

FFF0: 0204 0300           LI   R4,>0300
FFF4: 020C 1FB4           LI   R12,>1FB4
FFF8: 30C4                LDCR R4,3             ; jump to page 3 ?
FFFA: 0455                B    *R5

FFFC: FFFF                DATA >FFFF
FFFE: FFFF                DATA >FFFF










; ROM page 3.
; Self-test routine (end)

; First an interrupt test
FC00: 001D 2060 008C      SLAM @>008C,1,2       ; update progress code in R6, Workspace >0080
FC06: 0300 0000           LIMI >0000            ; disable all interrupts

FC0A: 0201 0104           LI   R1,>0104         ; clear RAM from >0104 to >0180
FC0E: 04F1                CLR  *R1+
FC10: 0281 017F           CI   R1,>017F
FC14: 1AFC                JL   >FC0E

FC16: 0200 0154           LI   R0,>0154
FC1A: C800 0152           MOV  R0,@>0152        ; set-up pointer used by our test interrupt vector

FC1E: 04C2                CLR  R2               ; set up vectors for all masked interrupt
FC20: C4A2 FD82           MOV  @>FD82(R2),*R2   ; with contents of a table at offset >FD82
FC24: 05C2                INCT R2               ; why on earth don't they use MOV  @>FD82(R2),*R2+ ???
FC26: 0282 0040           CI   R2,>0040
FC2A: 1AFA                JL   >FC20

FC2C: 020C 1FA0           LI   R12,>1FA0
FC30: 1D08                SBO  >0008

FC32: 020C 1F80           LI   R12,>1F80
FC36: 1D0F                SBO  >000F            ; so level-15 interrupt is pending
FC38: 1D08                SBO  >0008            ; and level-8
FC3A: 1D03                SBO  >0003            ; and level-3

FC3C: C020 0154           MOV  @>0154,R0        ; should still be 0, since interrupts are disabled
FC40: 1637                JNE  >FCB0

FC42: 0300 000F           LIMI >000F            ; enable all interrupts
; At this point, the 3 pending interrupts should execute in the order of their priority, and
; append their ID at the location pointed by @>0152 - initially >0154, so we should have :
;0154: 0003 0008 000F

FC46: C020 0154           MOV  @>0154,R0        ; test 1st word
FC4A: 0280 0003           CI   R0,>0003
FC4E: 1630                JNE  >FCB0            ; jump on error
FC50: C020 0156           MOV  @>0156,R0        ; test 2nd word
FC54: 0280 0008           CI   R0,>0008
FC58: 162B                JNE  >FCB0
FC5A: C020 0158           MOV  @>0158,R0        ; test 3rd word
FC5E: 0280 000F           CI   R0,>000F
FC62: 1626                JNE  >FCB0

FC64: 020C 1F80           LI   R12,>1F80
FC68: 05A0 0150           INC  @>0150           ; set flag to ask level-3 routine to trigger level 3 and >F

FC6C: 1D08                SBO  >0008            ; trigger level 8 again
FC6E: C020 015A           MOV  @>015A,R0        ; test word
FC72: 0280 0008           CI   R0,>0008
FC76: 161C                JNE  >FCB0

FC78: C020 015C           MOV  @>015C,R0        ; level 3 should follow
FC7C: 0280 0003           CI   R0,>0003
FC80: 1617                JNE  >FCB0
FC82: C020 015E           MOV  @>015E,R0        ; then level >F
FC86: 0280 000F           CI   R0,>000F
FC8A: 1612                JNE  >FCB0

FC8C: 04C1                CLR  R1

FC8E: 05C1                INCT R1
FC90: 0281 0014           CI   R1,>0014         ; 10 iterations
FC94: 1B08                JH   >FCA6
FC96: 04C2                CLR  R2
FC98: 020C 1F80           LI   R12,>1F80
FC9C: 04A1 FDC0           X    @>FDC0(R1)       ; trigger interrupt
FCA0: 8042                C    R2,R1            ; the interrupt routine should set R2 to the same value as R1
FCA2: 1606                JNE  >FCB0
FCA4: 10F4                JMP  >FC8E            ; loop

FCA6: C020 0160           MOV  @>0160,R0        ; check we did not have spurious level 3,8 or >F interrupt
FCAA: 1602                JNE  >FCB0
FCAC: 0460 FDF2           B    @>FDF2           ; everything is fine

FCB0: 0460 FDEA           B    @>FDEA

; level-4 interrupt routine
FCB4: 0202 0002           LI   R2,>0002         ; set flag
FCB8: 101A                JMP  >FCEE
; level-5 interrupt routine
FCBA: 0202 0004           LI   R2,>0004
FCBE: 1017                JMP  >FCEE
; level-6 interrupt routine
FCC0: 0202 0014           LI   R2,>0014
FCC4: 1014                JMP  >FCEE
; level-7 interrupt routine
FCC6: 0202 0010           LI   R2,>0010
FCCA: 1011                JMP  >FCEE
; level-9 interrupt routine
FCCC: 0202 0006           LI   R2,>0006
FCD0: 100E                JMP  >FCEE
; level-10 interrupt routine
FCD2: 0202 000A           LI   R2,>000A
FCD6: 100B                JMP  >FCEE
; level-11 interrupt routine
FCD8: 0202 000C           LI   R2,>000C
FCDC: 1008                JMP  >FCEE
; level-12 interrupt routine
FCDE: 0202 0012           LI   R2,>0012
FCE2: 1005                JMP  >FCEE
; level-13 interrupt routine
FCE4: 0202 0008           LI   R2,>0008
FCE8: 1002                JMP  >FCEE
; level-14 interrupt routine
FCEA: 0202 000E           LI   R2,>000E
FCEE: 04A1 FDD4           X    @>FDD4(R1)       ; disable interrupt
FCF2: 0380                RTWP

; level-3 interrupt routine
FCF4: 02C0                STST R0
FCF6: 0240 000F           ANDI R0,>000F
FCFA: 0280 0002           CI   R0,>0002         ; value expected on a TMS9900
FCFE: 1675                JNE  >FDEA
FD00: C0E0 0152           MOV  @>0152,R3        ; load pointer
FD04: 0200 0003           LI   R0,>0003
FD08: C4C0                MOV  R0,*R3           ; append identifier
FD0A: 05E0 0152           INCT @>0152           ; increment pointer
FD0E: 020C 1F80           LI   R12,>1F80
FD12: 1E03                SBZ  >0003            ; clear interrupt
FD14: 0380                RTWP

; level-8 interrupt routine - cf level 3
FD16: 02C0                STST R0
FD18: 0240 000F           ANDI R0,>000F
FD1C: 0280 0007           CI   R0,>0007
FD20: 1664                JNE  >FDEA
FD22: C0E0 0152           MOV  @>0152,R3
FD26: 0200 0008           LI   R0,>0008
FD2A: C4C0                MOV  R0,*R3
FD2C: 05E0 0152           INCT @>0152
FD30: 020C 1F80           LI   R12,>1F80
FD34: C060 0150           MOV  @>0150,R1
FD38: 1302                JEQ  >FD3E
FD3A: 1D0F                SBO  >000F
FD3C: 1D03                SBO  >0003
FD3E: 1E08                SBZ  >0008
FD40: 0380                RTWP

; level-15 interrupt routine - cf level 3
FD42: 02C0                STST R0
FD44: 0240 000F           ANDI R0,>000F
FD48: 0280 000E           CI   R0,>000E
FD4C: 164E                JNE  >FDEA
FD4E: C0E0 0152           MOV  @>0152,R3
FD52: 0200 000F           LI   R0,>000F
FD56: C4C0                MOV  R0,*R3
FD58: 05E0 0152           INCT @>0152
FD5C: 020C 1F80           LI   R12,>1F80
FD60: 1E0F                SBZ  >000F
FD62: 0380                RTWP

; level 0,1,2 interrupt routine
FD64: 0460 FDEA           B    @>FDEA

; restore interrupt vector table with the table saved at >0180
FD68: 04C1                CLR  R1
FD6A: 0202 0180           LI   R2,>0180
FD6E: CC72                MOV  *R2+,*R1+
FD70: 0281 0040           CI   R1,>0040
FD74: 11FC                JLT  >FD6E

FD76: 02E0 0100           LWPI >0100
FD7A: 020C 18A0           LI   R12,>18A0
FD7E: 1E08                SBZ  >0008
FD80: 045B                B    *R11

; table with the interrupt vectors used by the test
FD82: 0100 FD64           DATA >0100,>FD64      ; level-0 masked interrupt
FD86: 0100 FD64           DATA >0100,>FD64
FD8A: 0100 FD64           DATA >0100,>FD64
FD8E: 0120 FCF4           DATA >0120,>FCF4
FD92: 0100 FCB4           DATA >0100,>FCB4
FD96: 0100 FCBA           DATA >0100,>FCBA
FD9A: 0100 FCC0           DATA >0100,>FCC0
FD9E: 0100 FCC6           DATA >0100,>FCC6
FDA2: 0128 FD16           DATA >0128,>FD16
FDA6: 0100 FCCC           DATA >0100,>FCCC
FDAA: 0100 FCD2           DATA >0100,>FCD2
FDAE: 0100 FCD8           DATA >0100,>FCD8
FDB2: 0100 FCDE           DATA >0100,>FCDE
FDB6: 0100 FCE4           DATA >0100,>FCE4
FDBA: 0100 FCEA           DATA >0100,>FCEA
FDBE: 0130 FD42           DATA >0130,>FD42      ; level-15 masked interrupt

; instruction table to enable interrupts
FDC2: 1D04                SBO  >0004
FDC4: 1D05                SBO  >0005
FDC6: 1D09                SBO  >0009
FDC8: 1D0D                SBO  >000D
FDCA: 1D0A                SBO  >000A
FDCC: 1D0B                SBO  >000B
FDCE: 1D0E                SBO  >000E
FDD0: 1D07                SBO  >0007
FDD2: 1D0C                SBO  >000C
FDD4: 1D06                SBO  >0006
; instruction table to disable interrupts
FDD6: 1E04                SBZ  >0004
FDD8: 1E05                SBZ  >0005
FDDA: 1E09                SBZ  >0009
FDDC: 1E0D                SBZ  >000D
FDDE: 1E0A                SBZ  >000A
FDE0: 1E0B                SBZ  >000B
FDE2: 1E0E                SBZ  >000E
FDE4: 1E07                SBZ  >0007
FDE6: 1E0C                SBZ  >000C
FDE8: 1E06                SBZ  >0006

; routine used by start-up code, and level 0,1,2 interrupt vectors
FDEA: 06A0 FD68           BL   @>FD68
FDEE: 0460 FE20           B    @>FE20


FDF2: 06A0 FD68           BL   @>FD68
FDF6: 0206 0400           LI   R6,>0400
FDFA: C806 008C           MOV  R6,@>008C
FDFE: 0706                SETO R6
FE00: 0066 4020 FE14      MOVS R6,@>FE14,R0,4
FE06: 0C07                CED                   ; Convert Extended integer to Double precision real
FE08: 0706                SETO R6
FE0A: 0046 8800 FE18      CS   R6,R0,@>FE18,8   ; test result
FE10: 1607                JNE  >FE20
FE12: 1009                JMP  >FE26

; 32 bit integer
FE14: 5A4B 4019           DATA >5A4B,>4019
; double precision real :
FE18: 485A 4B40 1900 0000 DATA >485A,>4B40,>1900,>0000

; error exit routine : handles a cross-page jump, yes sir
FE20: 0205 FC08           LI   R5,>FC08         ; error return address
FE24: 1002                JMP  >FE2A

; normal exit : same idea
FE26: 0205 FC1C           LI   R5,>FC1C         ; successful return address

FE2A: 0204 0000           LI   R4,>0000
FE2E: C804 0088           MOV  R4,@>0088        ; move current R4 to future R4
FE32: C805 008A           MOV  R5,@>008A        ; same story
FE36: 02CC                STST R12
FE38: 026C 0010           ORI  R12,>0010        ; set "writable control store" bit in ST to use custom XOP
FE3C: 008C                LST  R12
FE3E: 2D40                XOP  R0,5             ; this instruction must be defined by LCS
FE40: 02E0 0080           LWPI >0080            ; change WP
FE44: 04CC                CLR  R12
FE46: 008C                LST  R12              ; clear ST
FE48: 020C 1FB4           LI   R12,>1FB4
FE4C: 30C4                LDCR R4,3             ; switch to page #0 ?
FE4E: 0455                B    *R5


; The ROM is padded with 1s
; We have a lot of free space.  Quite a change from TI990/4 ROMs.
FE50: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FE60: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FE70: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FE80: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FE90: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FEA0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FEB0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FEC0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FED0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FEE0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FEF0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF00: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF10: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF20: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF30: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF40: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF50: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF60: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF70: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF80: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FF90: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FFA0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FFB0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FFC0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FFD0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FFE0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF
FFF0: FFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFF   DATA >FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF,>FFFF









; The second half of this ROM makes strictly no sense as 990/12 machine code.
; Weird, weird...  Maybe it is a microcode ROM, or a data ROM of some sort ?
;
; The data should obviously be grouped by 4 words.  Consecutive sequences are often really close,
; too.
;

0000: 10F8
0002: 2F1D
0004: 0701
0006: 282E

0008: 1CF8
000A: 2F1D
000C: 0701
000E: 2809

0010: 10F8
0012: 2F1D
0014: 970F
0016: 2806

0018: 10F8
001A: 2F1D
001C: 970F
001E: 2807

0020: 10F8
0022: 2F1D
0024: 970F
0026: 2808

0028: 1CF8
002A: 2F1D
002C: 0701
002E: 281F

0030: 1CF8
0032: 2F1D
0034: 0701
0036: 282C

0038: 1CF8
003A: 2F1D
003C: 0701
003E: 282C

0040: 1CF8
0042: 2F1D
0044: 0701
0046: 282C

0048: 1029
004A: AC1E
004C: 970E
004E: 841F

0050: 1C29
0052: AF1D
0054: 0700
0056: 840F

0058: FC80
005A: 2F11
005C: 0500
005E: 84A6

0060: 1CF8
0062: 2E1D
0064: 2F00
0066: 840F

0068: 1C69
006A: EC1D
006C: 07B0
006E: 841F

0070: 48F8
0072: 2A1D
0074: 0400
0076: 840F

0078: 178F
007A: B71D
007C: 0710
007E: 840F

0080: 1CEF
0082: 0E1D
0084: 080E
0086: A910

0088: 1CF8
008A: 2C1D
008C: 07A0
008E: 840B

0090: 1CF8
0092: 2C1D
0094: 07F0
0096: 8400

0098: 1CF8
009A: 2C1D
009C: 0770
009E: 8401

00A0: 1CF8
00A2: 2F1C
00A4: 4700
00A6: 840F

00A8: 1CF8
00AA: 2F1D
00AC: 0701
00AE: 160F

00B0: 1CF8
00B2: 2C1E
00B4: 0700
00B6: 841F

00B8: FC40
00BA: 2F11
00BC: 0700
00BE: 84C8

00C0: 1C8F
00C2: AF9D
00C4: 0500
00C6: 840F

00C8: 0CF8
00CA: 2A9D
00CC: 2A00
00CE: A819

00D0: FC80
00D2: 2F11
00D4: 0500
00D6: 84A6

00D8: 0CF8
00DA: 2A1D
00DC: 2F00
00DE: 840F

00E0: 1748
00E2: AF1D
00E4: 0700
00E6: 840F

00E8: 4AF8
00E8: 2E1D
00EC: 0740
00EE: 840F

00F0: 49F8
00F2: 2D1D
00F4: 0741
00F6: 282C

00F8: FC01
00FA: 6F1D
00FC: 0700
00FE: 8480

0100: 107B
0102: 2F1D
0104: 0400
0106: 840F

0108: 1CF8
010A: 2C1E
010C: 0700
010E: 840B

0110: F380
0112: 2F11
0114: 6710
0116: 84E0

0118: 1CF8
011A: 2C1D
011C: 07B0
011E: 84F1

0120: 1388
0122: AF1D
0124: 0770
0126: 840F

0128: 1388
012A: 8F0D
012C: 17AE
012E: 09C0

0130: 10F8
0132: 2F1D
0134: 0700
0136: 840F

0138: 1588
013A: AF0D
013C: 17AE
013E: 840F

0140: 1E88
0142: AF9D
0144: 0070
0146: 840F

0148: 1688
014A: BF9D
014C: 9071
014E: E82A

0150: 1388
0152: 9F1D
0154: 8F10
0156: A924

0158: 1CF8
015A: 2F1D
015C: 6F01
015E: AC23

0160: 1C97
0162: 8F0D
0164: 0400
0166: 840F

0168: 1CF8
016A: 379C
016C: 0201
016E: 2001

0170: 1E8F
0172: AF1E
0174: 4711
0176: 082F

0178: 1D88
017A: AF19
017C: 0710
017E: 0843

0180: 1CF8
0182: 2F1D
0184: B70E
0186: 0856

0188: 1CF8
018A: 2F1D
018C: BF0F
018E: 2984

0190: 1CF8
0192: 2F1D
0194: B70E
0196: 0864

0198: 1CF8
019A: 2F1D
019C: BF0E
019E: 0873

01A0: 10F8
01A2: 2F1D
01A4: B70E
01A6: 0900

01A8: 10F8
01AA: 2F1D
01AC: BF0E
01AE: 09C1

01B0: 10F8
01B2: 2F1D
01B4: BF0E
01B6: 09EB

01B8: 1CF8
01BA: 2F1D
01BC: BF0E
01BE: 08C0

01C0: 1CF8
01C2: 2F1D
01C4: BF0E
01C6: 087C

01C8: 10F8
01CA: 2F1D
01CC: BF0E
01CE: 088C

01D0: 1009
01D2: EF05
01D4: BF0E
01D6: 9F02

01D8: 1E48
01DA: AF1D
01DC: 0700
01DE: 094A

01E0: 1F88
01E2: CF0D
01E4: 4F9E
01E6: 0976

01E8: 1D88
01EA: AF1F
01EC: 170E
01EE: 0974

01F0: 0629
01F2: E91D
01F4: 570F
01F6: E93F

01F8: FC61
01FA: EA1D
01FC: 07A0
01FE: 844F

0200: 1CF8
0202: 2C9D
0204: 00A0
0206: 8405

0208: 20EE
020A: AA9D
020C: 2801
020E: E842

0210: 1CF8
0212: 2F9C
0214: 4200
0216: 640F

0218: 1C09
021A: CF1D
021C: C700
021E: 0974

0220: FC81
0222: EF1D
0224: 0500
0226: 8429

0228: 1CDC
022A: AF0D
022C: 2FA0
022E: 094A

0230: 2CD6
0232: AF1D
0234: 0790
0236: 0947

0238: 2CD2
023A: AF1D
023C: 4D0E
023E: 0976

0240: 1009
0242: EC1D
0244: 179E
0246: 84F0

0248: 0EF8
024A: 2D1D
024C: 8F41
024E: C94D

0250: 1CED
0252: 2D1D
0254: 0780
0256: 084F

0258: 1CF8
025A: 2D1D
025C: 0780
025E: 084D

0260: 1C09
0262: EF1D
0264: 0781
0266: 284F

0268: 4C29
026A: EF1D
026C: 0700
026E: 0852

0270: 1EF8
0272: 2F1D
0274: 0700
0276: 6A4D

0278: 0CF8
027A: 291D
027C: 507E
027E: 840F

0280: 1C29
0282: FF1D
0284: 570E
0286: 0852

0288: 16F8
028A: 2F1D
028C: 0700
028E: 6A4F

0290: FC81
0292: EF1D
0294: 05F0
0296: 8429

0298: 0CEE
029A: 2A1D
029C: 2500
029E: 840F

02A0: 1CE5
02A2: AE1D
02A4: 2F00
02A6: 840F

02A8: 1CF8
02AA: 2F1D
02AC: 0700
02AE: 62FF

02B0: 1009
02B2: AF1D
02B4: 07A0
02B6: 0974

02B8: 1B08
02BA: AF0D
02BC: CF10
02BE: 094A

02C0: 11F8
02C2: 2D1D
02C4: 4D1E
02C6: 0976

02C8: 1CF8
02CA: 2F1D
02CC: 0700
02CE: 0947

02D0: 1CF8
02D2: 2F1D
02D4: 0700
02D6: 094F

02D8: 0029
02DA: A91D
02DC: 570E
02DE: 0947

02E0: 40EE
02E2: 2C1D
02E4: 0FBE
02E6: 8412

02E8: 10EE
02EA: 2E1D
02EC: 0F0E
02EE: A85D

02F0: 10EE
02F2: 2E1D
02F4: 0FDE
02F6: 840F

02F8: 10EE
02FA: 2E1D
02FC: 0F0E
02FE: A95F

0300: 1798
0302: 0E1D
0304: 0700
0306: 840F

0308: 2680
030A: 0F1D
030C: 0700
030E: A2FF

0310: 1B10
0312: 2F1D
0314: 0710
0316: A2FF

0318: 1C89
031A: EF1C
031C: 0700
031E: 6758

0320: 1009
0322: AF1D
0324: CF00
0326: 0974

0328: 1108
032A: AC0D
032C: 17AE
032E: 840F

0330: FC21
0332: CD1D
0334: 4D0E
0336: 8420

0338: 8C85
033A: 2F1D
033C: E7FE
033E: 086B

0340: 2E27
0342: 2F1D
0344: 9700
0346: A867

0348: 1E1B
034A: 2F1D
034C: 0700
034E: 840F

0350: 14F8
0352: 2F1D
0354: 0700
0356: 6766

0358: FC41
035A: EF1D
035C: 0700
035E: 841F

0360: 0C83
0362: 2F1D
0364: 0400
0366: 9F0E

0368: 0CA7
036A: EC1E
036C: 0700
036E: 8410

0370: 1C48
0372: AF05
0374: 0700
0376: A271

0378: 1C8E
037A: AF11
037C: 0700
037E: 840F

0380: 1CF8
0382: 2F1D
0384: 0700
0386: 62FF

0388: 1C8E
038A: AF11
038C: 0700
038E: 840F

0390: 1C50
0392: 2F0D
0394: 0701
0396: 62FF

0398: 1009
039A: EF1D
039C: 4D0E
039E: 0974

03A0: FC61
03A2: EF1D
03A4: C400
03A6: 8480

03A8: 1CF8
03AA: 301D
03AC: 07F0
03AE: 840F

03B0: 1CF8
03B2: 2C1D
03B4: 4D0E
03B6: 8480

03B8: 0001
03BA: EF1D
03BC: 0040
03BE: 840F

03C0: 0CCD
03C2: 6A1D
03C4: E77E
03C6: 840F

03C8: 1CF8
03CA: 3F1D
03CC: 0701
03CE: A2FF

03D0: 4083
03D2: 0F1D
03D4: 0700
03D6: 840F

03D8: 1CF8
03DA: 2F1D
03DC: 0700
03DE: 62FF

03E0: FC81
03E2: EF1D
03E4: CD00
03E6: 843F

03E8: FC01
03EA: EA1D
03EC: 2F00
03EE: 840F

03F0: 1C29
03F2: EF1D
03F4: 0700
03F6: 0889

03F8: 1CE5
03FA: AE1D
03FC: 0700
03FE: 0888

0400: F081
0402: EF1D
0404: 0710
0406: 8437

0408: F1F8
040A: 2A1D
040C: 0710
040E: 840C

0410: 10ED
0412: 4D1D
0414: 0700
0416: 08F0

0418: 1C29
041A: EF1D
041C: 0700
041E: 0889

0420: 1CE5
0422: AE1D
0424: 0700
0426: 0888

0428: F080
042A: 2F1D
042C: 0710
042E: 8402

0430: 1188
0432: 2F1D
0434: 0710
0436: 840F

0438: 1CF8
043A: 2F1D
043C: 0700
043E: 6282

0440: 1CF8
0442: 2D1D
0444: 0700
0446: 62FF

0448: FC41
044A: EF1D
044C: 07A0
044E: 8437

0450: 1CF8
0452: 2C9D
0454: 02A0
0456: 840B

0458: 1CEE
045A: 2E9D
045C: 2200
045E: 688B

0460: 1089
0462: EF1D
0464: CF10
0466: 840F

0468: 1C88
046A: AF0D
046C: 07A0
046E: 9F02

0470: 1288
0472: 8F0D
0474: 17AE
0476: 840F

0478: 1609
047A: AF1D
047C: 9710
047E: A88F

0480: 17DF
0482: 0F0D
0484: 0710
0486: 0974

0488: F681
048A: 6F1D
048C: 0710
048E: 84AA

0490: 1189
0492: EF1D
0494: 0710
0496: 0976

0498: 10F8
049A: 2F1D
049C: 0700
049E: 08BC

04A0: 10F8
04A2: 2F1D
04A4: 0700
04A6: 08BC

04A8: F681
04AA: 6F1D
04AC: 0710
04AE: 84AA

04B0: F181
04B2: 6F1D
04B4: 0710
04B6: 8455

04B8: F180
04BA: 2F15
04BC: 0710
04BE: 8450

04C0: 1CF8
04C2: 2F1D
04C4: 0700
04C6: 0976

04C8: 1089
04CA: CF1E
04CC: 0700
04CE: 08BC

04D0: F680
04D2: 2F11
04D4: 0710
04D6: 8455

04D8: F181
04DA: 6F1D
04DC: 0710
04DE: 84AA

04E0: F180
04E2: 2F15
04E4: 0710
04E6: 84A0

04E8: 1CF8
04EA: 2F1D
04EC: 0700
04EE: 0976

04F0: 10F8
04F2: 2F1D
04F4: 0700
04F6: 08BC

04F8: F7E0
04FA: 2F1D
04FC: 0700
04FE: 8401

0500: 1788
0502: 2F1D
0504: 0710
0506: A295

0508: 17DB
050A: 8F0D
050C: 0710
050E: 08BE

0510: 1108
0512: AF36
0514: 0700
0516: 08B8

0518: 1CE5
051A: AE1D
051C: 0700
051E: 08B7

0520: 1CF8
0522: 2F1D
0524: 0700
0526: 08B8

0528: 1CF8
052A: 2F1D
052C: 0700
052E: 08B5

0530: FC01
0532: 6E1D
0534: 0700
0536: 840A

0538: 1CE5
053A: AD1D
053C: 0700
053E: 08B7

0540: 1C08
0542: EF19
0544: 0700
0546: 08B8

0548: 1CE5
054A: AE1D
054C: 0700
054E: 08B7

0550: 1CF8
0552: 2F1D
0554: 0700
0556: 08B8

0558: 1CF8
055A: 2F1D
055C: 0700
055E: 08B5

0560: FC01
0562: 6E1D
0564: 0700
0566: 8405

0568: 1CE5
056A: AD1D
056C: 0700
056E: 08B7

0570: F7E0
0572: 2F1D
0574: 0700
0576: 8400

0578: 1788
057A: 2F1D
057C: 6710
057E: A2A2

0580: 1CF8
0582: 2F1D
0584: 0700
0586: 08B8

0588: FCE5
058A: 2E1D
058C: 0700
058E: 8455

0590: 1CF8
0592: 2F1D
0594: 0700
0596: A2FF

0598: 1CF8
059A: 2F1D
059C: 0700
059E: 08BE

05A0: 1CF8
05A2: 2F1D
05A4: 6F01
05A6: 6CB0

05A8: FC01
05AA: EF1D
05AC: 0700
05AE: 840F

05B0: 1CAA
05B2: 6F1D
05B4: 0700
05B6: 640F

05B8: 1CF8
05BA: 2D1D
05BC: 0700
05BE: 62FF

05C0: 1CF8
05C2: 2F1D
05C4: 0700
05C6: 08BE

05C8: FC41
05CA: EA1D
05CC: 07A0
05CE: 845F

05D0: 1C8F
05D2: AF9D
05D4: 0500
05D6: 840F

05D8: 1CEE
05DA: 2E9D
05DC: 2200
05DE: 68BB

05E0: 16F8
05E2: 2F1D
05E4: 0600
05E6: 840F

05E8: 1CF8
05EA: 2F1D
05EC: 2F0E
05EE: 640F

05F0: FC81
05F2: EF1D
05F4: 0500
05F6: 845F

05F8: 1CF8
05FA: 2F1D
05FC: 2F00
05FE: 640F

0600: F181
0602: EF1D
0604: CF10
0606: 847F

0608: F281
060A: EF1D
060C: 0710
060E: 8459

0610: F381
0612: EF1D
0614: 0710
0616: 8455

0618: F481
061A: EF1D
061C: 0710
061E: 8453

0620: F581
0622: EF1D
0624: 0710
0626: 8451

0628: F681
062A: EF1D
062C: 0710
062E: 844D

0630: F781
0632: EF1D
0634: 0710
0636: 8433

0638: FC81
063A: 6F1E
063C: 6F00
063E: 8440

0640: 1CF8
0642: 2F19
0644: 0700
0646: 9F02

0648: 12F8
064A: 2F1D
064C: 0700
064E: 08F1

0650: 13F8
0652: 2F1D
0654: 0700
0656: 08F0

0658: 1388
065A: AF1E
065C: 0700
065E: 840F

0660: F000
0662: 6F11
0664: 0710
0666: 8455

0668: 14F8
066A: 2F1D
066C: 0700
066E: 08F0

0670: 15F8
0672: 2F1D
0674: 0700
0676: 08F0

0678: 16F8
067A: 2F1D
067C: 0700
067E: 08F1

0680: 1C89
0682: AF1D
0684: 0400
0686: 840F

0688: 1CF8
068A: 371D
068C: 0700
068E: 08E7

0690: 10F8
0692: 2F1D
0694: 0600
0696: 840F

0698: 1CF8
069A: 371D
069C: 0700
069E: 08E5

06A0: 15F8
06A2: 2F1D
06A4: 0700
06A6: 08F1

06A8: 10F8
06AA: 2F1D
06AC: 0600
06AE: 840F

06B0: 1C89
06B2: F71F
06B4: 0700
06B6: 08E5

06B8: 14F8
06BA: 2F1D
06BC: 0700
06BE: 08F1

06C0: 10F8
06C2: 2F1D
06C4: 0600
06C6: 840F

06C8: 1CF8
06CA: 371D
06CC: 0700
06CE: 08E5

06D0: 15F8
06D2: 2F1D
06D4: 0700
06D6: 08F0

06D8: 10F8
06DA: 2F1D
06DC: 0600
06DE: 840F

06E0: 1CF8
06E2: 3F1D
06E4: 0700
06E6: 08E5

06E8: 1C9D
06EA: 4F1D
06EC: 0700
06EE: 840F

06F0: 1CF8
06F2: 2F1D
06F4: 0700
06F6: A2E0

06F8: 1088
06FA: CF1D
06FC: 0711
06FE: 28CD

0700: 1CF8
0702: 2F1D
0704: 0700
0706: 6CE1

0708: FC81
070A: 6F1E
070C: 6700
070E: 84C0

0710: 1CF8
0712: 2F19
0714: 0700
0716: 9F02

0718: 13F8
071A: 2F1D
071C: 0700
071E: 08F1

0720: 1CF8
0722: 2F1D
0724: 0701
0726: 28CB

0728: 1C29
072A: AF1D
072C: 0700
072E: 08EE

0730: 1C2D
0732: 4F1D
0734: 0700
0736: 08B7

0738: 17F8
073A: 2F1D
073C: 0600
073E: 08F0

0740: 1C29
0742: EF1D
0744: 0700
0746: 08EE

0748: 1C2D
074A: CF1D
074C: 0700
074E: 08B7

0750: 1028
0752: AC1D
0754: 07A0
0756: 840F

0758: FC41
075A: EF1D
075C: 0700
075E: 847F

0760: 1C8F
0762: AF9D
0764: 0500
0766: 840F

0768: 1CEE
076A: AE9D
076C: 2A00
076E: 68ED

0770: 17F8
0772: 2F1D
0774: 0700
0776: 840F

0778: 1CEE
077A: 2F1D
077C: 2700
077E: 640F

0780: 1C89
0782: EF1D
0784: 2F00
0786: 640F

0788: 1C89
078A: AF1D
078C: 2F00
078E: 640F

0790: 1C89
0792: AF1D
0794: 07A0
0796: 840F

0798: FC41
079A: EF1D
079C: 0500
079E: 843F

07A0: 1C57
07A2: 2F0D
07A4: 2D00
07A6: 68F4

07A8: 1CF8
07AA: 2F1D
07AC: 0701
07AE: 28FF

07B0: 1CF8
07B2: 2F1D
07B4: 0701
07B6: 28FF

07B8: 1CF8
07BA: 2F1D
07BC: 0701
07BE: 28FF

07C0: 1CF8
07C2: 2F1D
07C4: 0701
07C6: 28FF

07C8: 1CF8
07CA: 2F1D
07CC: 0701
07CE: 28FF

07D0: 1CF8
07D2: 2F1D
07D4: 0701
07D6: 28FF

07D8: 1CF8
07DA: 2F1D
07DC: 0701
07DE: 28FF

07E0: 1CF8
07E2: 2F1D
07E4: 0701
07E6: 28FF

07E8: 1CF8
07EA: 2F1D
07EC: 0701
07EE: 28FF

07F0: 1CF8
07F2: 2F1D
07F4: 0701
07F6: 28FF

07F8: 1CF8
07FA: 2F1D
07FC: 0700
07FE: E4FF

0800: 1B08
0802: 8F0D
0804: CF10
0806: 0974

0808: 1B88
080A: AF15
080C: 0710
080E: 08F2

0810: 1B88
0812: AC1D
0814: 07F0
0816: 8408

0818: 0BB4
081A: 2F1D
081C: 0711
081E: 7804

0820: 1C89
0822: AF1D
0824: 07A0
0826: 094A

0828: 1CF8
082A: 2F1D
082C: 0700
082E: 0947

0830: 10F8
0832: 2F1D
0834: 0700
0836: 0976

0838: 10F8
083A: 2F1D
083C: 0700
083E: 097A

0840: 10F8
0842: 2F1D
0844: 0700
0846: 097E

08A8: 10F8
084A: 2F1D
084C: 0700
084E: 0981

0850: 1CF8
0852: 2F1D
0854: 0700
0856: 0947

0858: FBA4
085A: EF1D
085C: 0700
085E: 84FF

0860: 1B91
0862: 2F1D
0864: 0711
0866: A21C

0868: 1C90
086A: 2F0D
086C: 0710
086E: 093E

0870: 1C88
0872: AC1D
0874: 07F0
0876: 8450

0878: 0CF8
087A: 2A1D
087C: 0791
087E: A21A

0880: 1C91
0882: 2F1D
0884: 0710
0886: 091D

0888: 1A89
088A: EF1D
088C: 0710
088E: 840F

0890: 1A08
0892: AF1D
0894: 0700
0896: 094F

0898: 1A08
089A: AF1D
089C: 0700
089E: 092A

08A0: 1CF8
08A2: 2F1D
08A4: 0700
08A6: 095F

08A8: 10F8
08AA: 2F1D
08AC: 0700
08AE: 096B

08B0: 1CF8
08B2: 2F1D
08B4: 0700
08B6: 094C

08B8: 1CF8
08BA: 2F1D
08BC: 8F00
08BE: A912

08C0: 1CF8
08C2: 2F1D
08C4: 0700
08C6: 0942

08C8: 10F8
08CA: 2F1D
08CC: 0701
08CE: 290E

08D0: 1CF8
08D2: 2F1D
08D4: 0700
08D6: 0934

08D8: 10F8
08DA: 2F1D
08DC: 0701
08DE: 290B

08E0: 1B89
08E2: EF1D
08E4: 0721
08E6: 2902

08E8: 10F8
08EA: 2F1D
08EC: 0700
08EE: 0947

08F0: 1B28
08F2: AF25
08F4: 0700
08F6: 840F

08F8: 1B91
08FA: 2F25
08FC: 0700
08FE: A222

0900: 10F8
0902: 2F1D
0904: 0700
0906: 0976

0908: 1CF8
090A: 2F1D
090C: 0701
090E: 2947

0910: 1C95
0912: 4F0D
0914: 0700
0916: A225

0918: 10F8
091A: 2F1D
091C: 0700
091E: 097A

0920: 1CF8
0922: 2F1D
0924: 0701
0926: 2947

0928: 1C95
092A: 6F0D
092C: 0700
092E: A228

0930: 10F8
0932: 2F1D
0934: 0700
0936: 097E

0938: 1CF8
093A: 2F1D
093C: 0701
093E: 2947

0940: 10F8
0942: 2F1D
0944: 0700
0946: 0981

0948: 1CF8
094A: 2F1D
094C: 0701
094E: 2947

0950: 1B28
0952: AC25
0954: DFF0
0956: 8480

0958: 1C8D
095A: 2F1D
095C: 0700
095E: A22F

0960: 1C89
0962: EF05
0964: 0700
0966: 9F02

0968: 1CF8
096A: 2D1D
096C: 0400
096E: 840F

0970: 1CF8
0972: 2F1D
0974: 2F0E
0976: 640F

0978: 1C95
097A: 4F0D
097C: 0700
097E: A232

0980: 0C81
0982: 6F05
0984: 0700
0986: 9F02

0988: 1CF8
098A: 2D1D
098C: 0401
098E: 292E

0990: 1CF8
0992: 2D1D
0994: 4C01
0996: A22E

0998: 1CF8
099A: 2F1D
099C: DF0F
099E: 2931

09A0: 10F8
09A2: 2F1D
09A4: 0700
09A6: 840F

09A8: 1228
09AA: AF1D
09AC: 0700
09AE: 840F

09B0: 10F8
09B2: 2E1D
09B4: 0710
09B6: 840F

09B8: 1428
09BA: AF1D
09BC: 0700
09BE: 840F

09C0: 12F8
09C2: 2E1D
09C4: 0710
09C6: 840F

09C8: 1491
09CA: 6C1E
09CC: 0700
09CE: 8411

09D0: 1491
09D2: 6F1D
09D4: 0701
09D6: A23D

09D8: 1490
09DA: 2F1D
09DC: 0710
09DE: 613C

09E0: 1489
09E2: AF1D
09E4: 0710
09E6: 640F

09E8: 1488
09EA: AF39
09EC: 0710
09EE: 640F

09F0: 11F8
09F2: 2C1E
09F4: 17AE
09F6: 8411

09F8: 1E28
09FA: AF39
09FC: 0710
09FE: 840F

0A00: 1EF8
0A02: 2F1D
0A04: 0700
0A06: 840F

0A08: 2625
0A0A: 2F1D
0A0C: 9710
0A0E: 6840

0A10: 1188
0A12: AF0D
0A14: 17AE
0A16: 840F

0A18: 1C28
0A1A: AF1D
0A1C: 0700
0A1E: 840F

0A20: 1CEE
0A22: 8F1D
0A24: 0700
0A26: 840F

0A28: 1EF8
0A2A: 2E1D
0A2C: 0710
0A2E: 840F

0A30: 1EF8
0A32: 2F1D
0A34: 9700
0A36: 6843

0A38: 1088
0A3A: AF0D
0A3C: 17AE
0A3E: 840F

0A40: 1E88
0A42: EF1D
0A44: 0710
0A46: 840F

0A48: 16F8
0A4A: 2F1D
0A4C: 9700
0A4E: 6848

0A50: 10F8
0A52: 2C1D
0A54: 17AE
0A56: 8405

0A58: 1689
0A5A: EF1D
0A5C: 9710
0A5E: 684B

0A60: 1A91
0A62: 6C1E
0A64: 0700
0A66: 840A

0A68: 1A90
0A6A: 2F1D
0A6C: 0711
0A6E: 624E

0A70: FA80
0A72: 2F11
0A74: 0710
0A76: 64A1

0A78: 1C2B
0A7A: AC1E
0A7C: 0780
0A7E: 84E0

0A80: 1C48
0A82: AC29
0A84: 07A0
0A86: 8404

0A88: 1CAB
0A8A: CF1D
0A8C: 0700
0A8E: 840F

0A90: 1EE6
0A92: AF1D
0A94: 0700
0A96: 840F

0A98: 1EF8
0A9A: 2F1D
0A9C: 0700
0A9E: A059

0AA0: 1EE6
0AA2: AF1D
0AA4: 0700
0AA6: 840F

0AA8: 1EF8
0AAA: 2F1D
0AAC: 0700
0AAE: A059

0AB0: 1EE6
0AB2: AF1D
0AB4: 0700
0AB6: 840F

0AB8: 1EF8
0ABA: 2F1D
0ABC: 0700
0ABE: A059

0AC0: 10F8
0AC2: 2F1D
0AC4: 6700
0AC6: 640F

0AC8: 1F29
0ACA: EE1D
0ACC: 6FD0
0ACE: 840F

0AD0: FCA1
0AD4: 4F1D
0AD4: 0700
0AD6: 8401

0AD8: 1CEF
0ADA: AF1D
0ADC: 9701
0ADE: E85C

0AE0: 1018
0AE2: 2F1D
0AE4: 0700
0AE6: 840F

0AE8: 16F8
0AEA: 2D1D
0AEC: 0710
0AEE: 840F

0AF0: 17F8
0AF2: 2E1D
0AF4: 0710
0AF6: 640F

0AF8: FC61
0AFA: CF1D
0AFC: 0500
0AFE: 8460

0B00: 1C89
0B02: EF1D
0B04: 28A0
0B06: 840F

0B08: 1CF8
0B0A: 2F9D
0B0C: 2800
0B0E: 840F

0B10: 1CEE
0B12: 2E9D
0B14: 2001
0B16: E863

0B18: FC61
0B1A: CE1D
0B1C: 07D0
0B1E: 8460

0B20: 1C89
0B22: EF1D
0B24: 00A0
0B26: 840F

0B28: 1CF8
0B2A: 2F9D
0B2C: 2800
0B2E: 840F

0B30: 1CEE
0B32: 2E9D
0B34: 2001
0B36: E867

0B38: 1091
0B3A: 4F0D
0B3C: 07A0
0B3E: 840F

0B40: 1CEF
0B42: AF1D
0B44: 9701
0B46: E869

0B48: 18F8
0B4A: 2D1D
0B4C: 0710
0B4E: 840F

0B50: 19F8
0B52: 2E1D
0B54: 0710
0B56: 640F

0B58: 1928
0B5A: AC1D
0B5C: 07D0
0B5E: 8480

0B60: 1CAE
0B62: EE1D
0B64: 07D1
0B66: AC73

0B68: 1728
0B6A: AF1D
0B6C: 0700
0B6E: A2FE

0B70: 1CCA
0B72: 2C1E
0B74: 0700
0B76: 84F0

0B78: 2CA4
0B7A: EF11
0B7C: 0700
0B7E: 840F

0B80: 1628
0B82: AF1D
0B84: 0700
0B86: A2FE

0B88: 28E0
0B8A: 2F1D
0B8C: 0700
0B8E: 840F

0B90: 1CF8
0B92: 2F1D
0B94: 0700
0B96: 62FE

0B98: 1728
0B9A: AF1D
0B9C: 0701
0B9E: 62FE

0BA0: FC81
0BA2: EF1D
0BA4: 0500
0BA6: 8459

0BA8: 1CF8
0BAA: 2D1D
0BAC: 2F00
0BAE: 640F

0BB0: 1C89
0BB2: EF1C
0BB4: E70E
0BB6: 840F

0BB8: 1FF8
0BBA: 2C1F
0BBC: 17AE
0BBE: 8406

0BC0: 1EF8
0BC2: 2F1D
0BC4: EF0E
0BC6: 840F

0BC8: 14F8
0BCA: 2F1D
0BCC: 0600
0BCE: 6878

0BD0: 1CF8
0BD2: 2C1C
0BD4: 0700
0BD6: 8410

0BD8: 1FF8
0BDA: 2C1F
0BDC: 17AE
0BDE: 8406

0BE0: 1EF8
0BE2: 2F1D
0BE4: EF0E
0BE6: 840F

0BE8: 14F8
0BEA: 2F1D
0BEC: 0600
0BEE: 687C

0BF0: 1FF8
0BF2: 2C1F
0BF4: 17AE
0BF6: 8406

0BF8: 1EF8
0BFA: 2F1D
0BFC: F70E
0BFE: 840F

0C00: 14F8
0C02: 2F1D
0C04: 0600
0C06: 687F

0C08: 1FF8
0C0A: 2C1F
0C0C: 17AE
0C0E: 8406

0C10: 1EF8
0C12: 2F1D
0C14: FF0E
0C16: 840F

0C18: 14F8
0C1A: 2F1D
0C1C: 0600
0C1E: 6882

0C20: 1C89
0C22: EF1D
0C24: C780
0C26: 840F

0C28: 46F8
0C2A: 2F1D
0C2C: 0700
0C2E: AA85

0C30: 10F8
0C32: 2C1E
0C34: 0710
0C36: 8408

0C38: FC80
0C3A: 2F11
0C3C: 97FE
0C3E: 8411

0C40: F1EC
0C42: 4F1D
0C44: 0710
0C46: 8480

0C48: 1CF8
0C4A: 2C1E
0C4C: 0700
0C4E: 8420

0C50: 0008
0C52: AF11
0C54: 0740
0C56: 840F

0C58: 0109
0C5A: ED1D
0C5C: 0740
0C5E: 840F

0C60: 0F89
0C62: AF1D
0C64: 0740
0C66: 840F

0C68: 0989
0C6A: AF1D
0C6C: 0740
0C6E: 840F

0C70: 10F8
0C72: 291F
0C74: 7F00
0C76: 29BD

0C78: 10F8
0C7A: 291D
0C7C: 0700
0C7E: 840F

0C80: 10F8
0C82: 291D
0C84: 0700
0C86: 29BD

0C88: 1089
0C8A: AF1D
0C8C: 07A0
0C8E: 29BB

0C90: 13F8
0C92: 2D1D
0C94: 170E
0C96: 29BF

0C98: 1C88
0C9A: 8F0D
0C9C: 0780
0C9E: 29BF

0CA0: 1089
0CA2: AF1D
0CA4: 07A0
0CA6: 29BB

0CA8: 13F8
0CAA: 2D1D
0CAC: 170E
0CAE: 29BF

0CB0: 1089
0CB2: AF1D
0CB4: 07A0
0CB6: 29BB

0CB8: 13F8
0CBA: 2D1D
0CBC: 170E
0CBE: 29BF

0CC0: 10F8
0CC2: 2F1D
0CC4: 0700
0CC6: 840F

0CC8: 4981
0CCA: 6F1D
0CCC: 0700
0CCE: 840F

0CD0: 4F81
0CD2: 6F1D
0CD4: 0701
0CD6: A2B1

0CD8: 10F8
0CDA: 291D
0CDC: 0701
0CDE: A2A8

0CE0: 4080
0CE2: 2F1F
0CE4: 0740
0CE6: BA90

0CE8: 1CF8
0CEA: 2F1D
0CEC: 7700
0CEE: AD90

0CF0: 4120
0CF2: 2F1D
0CF4: 0740
0CF6: 840F

0CF8: 00F8
0CFA: 2E1D
0CFC: 0740
0CFE: A78E

0D00: 1CF8
0D02: 2C1E
0D04: 0700
0D06: 8410

0D08: 0088
0D0A: AF11
0D0C: 0740
0D0E: 840F

0D10: F0EC
0D12: 4F1D
0D14: 0710
0D16: 8480

0D18: 1CF8
0D1A: 2C1E
0D1C: 0700
0D1E: 8404

0D20: 0188
0D22: AF11
0D24: 0740
0D26: 840F

0D28: 02F8
0D2A: 2C1D
0D2C: 0740
0D2E: 8410

0D30: 1CF8
0D32: 2F0D
0D34: 0700
0D36: 9F02

0D38: 0FF8
0D3A: 2F1D
0D3C: 0741
0D3E: 298E

0D40: 4180
0D42: 2F05
0D44: 0700
0D46: 9F02

0D48: 40F8
0D4A: 2A1D
0D4C: 0700
0D4E: A790

0D50: 4080
0D52: 2F1D
0D54: 0740
0D56: 840F

0D58: 4281
0D5A: 2F1D
0D5C: 0740
0D5E: 840F

0D60: 1CF8
0D62: 2F1D
0D64: 0700
0D66: A2A6

0D68: 09F8
0D6A: 2F1D
0D6C: 0740
0D6E: 840F

0D70: 10F8
0D72: 2C1D
0D74: 0710
0D76: 8408

0D78: 1CF8
0D7A: 2C1E
0D7C: 0700
0D7E: 8402

0D80: 0088
0D82: AF11
0D84: 0741
0D86: 298E

0D88: 4080
0D8A: 2F1E
0D8C: 0740
0D8E: 840F

0D90: FCE0
0D92: 2F11
0D94: 0700
0D96: 840C

0D98: 1CF8
0D9A: 2F1D
0D9C: 0700
0D9E: A28E

0DA0: 10F8
0DA2: 2C1E
0DA4: 0700
0DA6: 8408

0DA8: 1388
0DAA: 2F11
0DAC: 177E
0DAE: 29C0

0DB0: 10F8
0DB2: 2F1D
0DB4: 0701
0DB6: 09B7

0DB8: 1CF8
0DBA: 2F1D
0DBC: 0701
0DBE: 09B8

0DC0: 17E0
0DC2: AD1D
0DC4: 0701
0DC6: 09B9

0DC8: 1CF8
0DCA: 2F1D
0DCC: 0700
0DCE: A2FE

0DD0: 1C88
0DD2: 2F1D
0DD4: 0701
0DD6: 2832

0DD8: 1328
0DDA: AC1D
0DDC: 07A0
0DDE: 840A

0DE0: 0CF0
0DE2: 6D1D
0DE4: 9700
0DE6: 68BC

0DE8: 1CF8
0DEA: 2F1C
0DEC: 4700
0DEE: 840F

0DF0: 13F8
0DF2: 2F1D
0DF4: 170E
0DF6: 840F

0DF8: 1EF8
0DFA: 2C1D
0DFC: EF11
0DFE: 120F

0E00: 0EF8
0E02: 2C1D
0E04: EF11
0E06: 140F

0E08: 1549
0E0A: EC1D
0E0C: CF10
0E0E: 8403

0E10: 1389
0E12: 6F1D
0E14: 0710
0E16: 840F

0E18: 1CF8
0E1A: 2C1E
0E1C: 0700
0E1E: 84FE

0E20: F280
0E22: 2F11
0E24: 0710
0E26: 84FF

0E28: 1C68
0E2A: AC0D
0E2C: 07B0
0E2E: 8420

0E30: 1C8F
0E32: AF1D
0E34: 0500
0E36: 840F

0E38: 1CF8
0E3A: 2F1D
0E3C: 2700
0E3E: 840F

0E40: 1CEF
0E42: 0F1D
0E44: 080E
0E46: A9C8

0E48: 17F8
0E4A: 2E1D
0E4C: 0710
0E4E: 840F

0E50: 13E0
0E52: AD1D
0E54: 0700
0E56: 840F

0E58: 1708
0E5A: AF1D
0E5C: 0700
0E5E: A2FE

0E60: 12E0
0E62: AD1D
0E64: 0700
0E66: 840F

0E68: 1308
0E6A: AF1D
0E6C: 0700
0E6E: A2FE

0E70: 1228
0E72: AF1D
0E74: 0700
0E76: 840F

0E78: 1CEF
0E7A: 8F1D
0E7C: 0700
0E7E: 840F

0E80: 13F8
0E82: 2D1D
0E84: 0710
0E86: 840F

0E88: 12F8
0E8A: 2E1D
0E8C: 0710
0E8E: 840F

0E90: FC47
0E92: 2F1D
0E94: 0700
0E96: 8420

0E98: 1597
0E9A: 4F15
0E9C: 0700
0E9E: 840F

0EA0: 1CF8
0EA2: 2F1D
0EA4: 0700
0EA6: A2C5

0EA8: F781
0EAA: 6F1D
0EAC: 0710
0EAE: 8420

0EB0: 1C49
0EB2: CC1E
0EB4: 0700
0EB6: 84A0

0EB8: FC61
0EBA: 6F1D
0EBC: 0700
0EBE: 8406

0EC0: 1C29
0EC2: 6C1D
0EC4: 07A0
0EC6: 8400

0EC8: 1C8F
0ECA: AF1D
0ECC: 0500
0ECE: 840F

0ED0: 1CF8
0ED2: 2E1D
0ED4: 2700
0ED6: 840F

0ED8: 1CEE
0EDA: 2E1D
0EDC: 080E
0EDE: A8DB

0EE0: 1C17
0EE2: 2F11
0EE4: 0700
0EE6: 840F

0EE8: 1CED
0EEA: 6F1D
0EEC: 0700
0EEE: 840F

0EF0: 1CE5
0EF2: AE1D
0EF4: 0700
0EF6: 840F

0EF8: 1C0F
0EFA: AF1D
0EFC: 0700
0EFE: A2FE

0F00: 1CED
0F02: 8F1D
0F04: 0700
0F06: 840F

0F08: 17E0
0F0A: AD15
0F0C: 0700
0F0E: 840F

0F10: 1C59
0F12: 6F1D
0F14: 0700
0F16: A2D7

0F18: 1629
0F1A: EC1D
0F1C: 0710
0F1E: 8480

0F20: 1608
0F22: EC15
0F24: 07A0
0F26: 8400

0F28: FC61
0F2A: 6F1D
0F2C: 0700
0F2E: 8406

0F30: FC41
0F32: EF1D
0F34: 0500
0F36: 8401

0F38: 1CF8
0F3A: 2F1D
0F3C: 2F00
0F3E: 840F

0F40: 1CEE
0F42: 2E1D
0F44: 080E
0F46: A8E8

0F48: 1CE5
0F4A: AE1D
0F4C: 0700
0F4E: AEFE

0F50: 1CF8
0F52: 2F1D
0F54: 0700
0F56: 62FE

0F58: F001
0F5A: EF1D
0F5C: CF00
0F5E: 845F

0F60: FC41
0F62: EA1D
0F64: 0710
0F66: 841F

0F68: 1BF8
0F6A: 2C1D
0F6C: 0710
0F6E: 8404

0F70: FA81
0F72: EF1D
0F74: 0710
0F76: 8456

0F78: 1C29
0F7A: 6C1D
0F7C: 07A0
0F7E: 8400

0F80: 1C8F
0F82: AF1D
0F84: 0500
0F86: 840F

0F88: 1BF8
0F8A: 2E1D
0F8C: 2F00
0F8E: 840F

0F90: 1BEE
0F92: 2E1D
0F94: 0E0E
0F96: A8F2

0F98: 1CE5
0F9A: AE1D
0F9C: 0700
0F9E: 840F

0FA0: 1AE0
0FA2: AD1D
0FA4: 0700
0FA6: A2FE

0FA8: 1C0B
0FAA: 8F9D
0FAC: 0700
0FAE: A2EF

0FB0: 1C29
0FB2: EF1D
0FB4: 07A0
0FB6: 840F

0FB8: 1BF8
0FBA: 2E1D
0FBC: 2600
0FBE: 840F

0FC0: 1BEE
0FC2: 2E1D
0FC4: 0E0F
0FC6: E8F9

0FC8: FC01
0FCA: EF1D
0FCC: 0700
0FCE: 84B0

0FD0: 1CE5
0FD2: AE1D
0FD4: 0700
0FD6: 840F

0FD8: 1CF8
0FDA: 2F1D
0FDC: 0700
0FDE: 62FE

0FE0: 1CF8
0FE2: 2F1D
0FE4: 0701
0FE6: 29FE

0FE8: 1CF8
0FEA: 2F1D
0FEC: 0701
0FEE: 29FE

0FF0: 1CF8
0FF2: 2F1D
0FF4: 0700
0FF6: E4FE

0FF8: AAAA
0FFA: 5555
0FFC: 00AA
0FFE: E3C8